Concatenating leaks your secret key to the website. If a hacker can add JavaScript to the login page of _any_ site you use, then they can record your plaintext

Concatenating leaks your secret key to the website. If a hacker can add JavaScript to the login page of _any_ site you use, then they can record your plaintext password and log into _every_ site you use. Given the reddit password it's immediately obvious that "facebook$myname$123456" is your facebook password. The tool uses scrypt to make it hard to figure out the secret key from the generated password.