Well, the relevant search space when reversing a hash is the space of original passwords, and you do have to remember your master password. The attack to worry

Well, the relevant search space when reversing a hash is the space of original passwords, and you do have to remember your master password. The attack to worry about with these systems is a website taking your generated password and maliciously reversing it to reveal your master password, not that someone will steal your hashed password from a database where it'll have been hashed again and stored securely, and then reverse it twice to reveal your original master password. Their FAQ seems to say that they salt with other data before hashing, so they should at least be safe from precomputed lookup tables. I don't know how feasible it'd be to crack a hashed, salted password, but they'd probably be better off using blowfish or one of the other algorithms from the "Storing Passwords Securely" article which is now on the front page [1]. And I'm not sure why they mention using l33t-speak to protect your password from being reversed. That's just bizarre. The information on their website makes me worry that they may not know what they're doing, though maybe I'm just misinterpreting it. [1] http://throwingfire.com/storing-passwords-securely/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+throwingfire+%28Throwing+Fire%29#notpasswordhashes http://throwingfire.com/storing-passwords-securely/?utm_sour...