"If I get a couple (or more) of your passwords, I can probably figure out your master password, since I know everything else." Not really. The algorithm return

"If I get a couple (or more) of your passwords, I can probably figure out your master password, since I know everything else." Not really. The algorithm returns a portion of the SHA-256 hash of the concatenated master password and service. SHA-256 is widely believed to be a one-way function (see http://en.wikipedia.org/wiki/One-way_function http://en.wikipedia.org/wiki/One-way_function for details), meaning that it is essentially computationally impossible to get the inputs from the hash, or even many millions of related hashes. If such an attack exists, it represents a major vulnerability to electronic infrastructure worldwide. If you want to give it a shot, the first screenshot uses my actual master password (which I've been using for years). The password generated for "app store" is "35463F2465b%". I'll probably put the source for the program on github.com/alexbecker tomorrow. Granted, if the master password is sufficiently simple to guess the app is not secure. But that's unavoidable; the entire point of having a single password is that you can afford to make it secure.