4 ms·

How safe is it? If everyone started using this, couldn't password crackers adapt? In the recent LinkedIn leak for example, instead of looking for sha1('password

• rowanseymour 14y ago
  I haven't checked what the hash function and length used in PwdHash is but I use PasswordMaker which is kinda the same thing except you can specify exactly how the hash is generated from your master password. Because you don't have to remember the hash it can be as long as the website allows. If you use say.. 12+ characters of SHA-256 with alpha/numbers/symbols then it's probably going to take hackers at least a few years to find your master password.
• harshreality 14y ago
  That's correct, although with some variants you specify charset and length so there end up being tens of possibilities (lcase? ucase? digits? symbols? length=8,10,12,16...) rather than just one. The idea is that you use a passphrase that's reasonably secure, so that it cannot be brute forced. I used to use a similar password hasher browser extension, and I think it's fine as long as the seed passphrase is sufficiently secure. However, now I prefer keepass/lastpass/1password with random passwords. Not having to type in the passphase as often makes it easier for the average person to use a more secure passphrase.