Interesting idea. To take it a step further, for sites/accounts you want to reduce the chances of someone gaining access to from a single compromised device you

Interesting idea. To take it a step further, for sites/accounts you want to reduce the chances of someone gaining access to from a single compromised device you can split the one-time password into two (or more) different parts: 1. First half of the new one-time key goes to a pre-designated email address 2. Second half of the key goes to a pre-designated mobile device over SMS Both need to be entered into the sign in form before you'll be able to access the site/account. The scheme is extensible to include deeper levels of security, too, for situations where your user community is really concerned with access: * Email_key + SMS_key + n-digit_PIN * Email_key + SMS_key + Pre-paired-hardware_key * Email_key + SMS_key + XKCD-style-passphrase The idea seems straight-forward enough to me that I'd be surprised if someone hasn't already written an authentication library that does something similar. It would be extra steps and a hassle, but like you, I feel that it's already a hassle to use a password manager.