Supergenpass is only okay(-ish) if your master password is a large enough completely random string (e.g. 128-bit string: `head -c16 /dev/urandom | base64`). If

Supergenpass is only okay(-ish) if your master password is a large enough completely random string (e.g. 128-bit string: `head -c16 /dev/urandom | base64`). If you use weak password (e.g. the one you can remember), it's trivial to bruteforce it, as it uses MD5(master_password || ':' || domain || length) to derive passwords. Another problem with any Supergenpass-like password generator is that once the attacker steals or guesses your master password, she will be able to generate your future passwords. I describe password generators like Supergenpass as a rough equivalent of password manager with the attacker having a permanent read-only access to the encrypted database.