> * If a site stores password data in cleartext or weakly hashed, your master password/passphrase can potentially be cracked. It all comes down to the threat m

> * If a site stores password data in cleartext or weakly hashed, your master password/passphrase can potentially be cracked. It all comes down to the threat model you are defending against. The threat model I'm defending against is automated attempts to catch me reusing the same password with different accounts. Even if you were defending against a motivated actor putting human eyes on your passwords, something like`XXXXXXsXXXXXXsssXX` where the X are reused across sites and the s is a derived, site-specific chunk is a) as good as completely random until your adversary is manually correlating multiple leaked passwords for you and b) not trivially obvious to derive once they are correlating multiple leaked passwords.