Most password manager ecosystems consider this vector. They're either zero knowledge (bitwarden, lastpass ...), local(keypass, pass, buttercup ...), or are vuln

Most password manager ecosystems consider this vector. They're either zero knowledge (bitwarden, lastpass ...), local(keypass, pass, buttercup ...), or are vulnerable in the way you describe and suck. Hashing is sure an interesting way to create passwords. I've considered it as well. I liked that it protects you from credential stuffing and it's stateless. But I found it hit practical roadblocks I couldn't route around: * you need a plaintext that wont change at the site, but will change across sites. URL is most common, but URL's can change. * if that site does have password requirements and your digest fails to meet those requirements, you have to either iterate or alter your plaintext (and remember) or alter your digest (changes everything), or alter for that specific site (and remember). * sites often have password rotation requirements because users frequently use bad passwords across sites and that basically forces you to remember state. * If you store any of this state, it's no longer stateless and you hit all the problems of syncing across devices and so on and so forth. What do you use for your plaintext anyway?