You can't. The best you can do is something like PBKDF2 or scrypt or bcrypt. But they won't generate a strong cryptographic key. If you start with a weak password or weak passphrase, and derive a cryptographic key from it, the result will inevitably be not very strong. Functions like PBKDF2 or scrypt or bcrypt are not a silver bullet. They make things a little less bad than they otherwise would be, but ultimately, it's still bad; it's just less bad than it could be. It's certainly not good, and it's not going to result in a key that I would call strong.
The #1 thing you can do is: don't do that. Don't generate cryptographic keys from passwords or passphrases. Humans are not very good at choosing or remembering high-entropy passwords/passphrases. As a result, given what we know about human behavior, if you derive a cryptographic key from a password/passphrase, your data will be a lot less secure than one would hope.
Instead, if you want strong security, choose a truly random cryptographic key (not one derived from a password/passphrase). Use proper key management. Yes, this is more work. Achieving strong security does require more work. Depending upon your requirements, it's even possible that you might not be able to achieve your security goals within a browser environment. That's life. If you need strong security, the worst thing you can do is give users a false sense of security: make them think they're safe, when actually they have only limited protection.