I mean, it's great to "not store state" until you get to the last part of your comment: "possibly a few custom parameters describing password rules for weird si

I mean, it's great to "not store state" until you get to the last part of your comment: "possibly a few custom parameters describing password rules for weird sites", plus it also needs to include things like the number times you've rotated the password for each site. The point of my question was to ask how well your implementation manages state across multiple machines, but if your answer is "it doesn't need to" then I just don't see how you can satisfy my requirements.