Best way on the client side

Use MD5 hashing!

General best bet

Let a backend handle the validation.

Alternatively

You could acquire them from the server. And load them directly into a Closure.

That way it won't be available as a public variable, and the words would be sent at the last possible minute. To add to it, you could obfuscate it, or let the back-end handle the validation.

var validate = (function(){

    var words;



    // some ajax code to load the words...



    return function(word){

         // loop through words to see if it is there.'

         return true;

    }

})();

And then add to that, some obfuscation, as the others have mentioned. This is probably as much as you can do, to make it a bit harder, to get to. But no matter what, as long as you do the validation client side.