It's remarkably hard to get this right. pwdhash notes[1] that being a browser plugin stops JavaScript grabbing the password, but it's still possible with Flash

It's remarkably hard to get this right. pwdhash notes[1] that being a browser plugin stops JavaScript grabbing the password, but it's still possible with Flash. Third-party ports to other browsers don't even have the JS protection. pwdhash still leaks the length of the password since it aims to give users visual feedback of characters being typed. Then you've also got the issue of automatic update of plugins being compromised. The question is really: is it more secure than the alternatives? 1: http://crypto.stanford.edu/PwdHash/pwdhash.pdf http://crypto.stanford.edu/PwdHash/pwdhash.pdf