SuperGenPass[1] seems to be a much better alternative to this, since it actually hashes your codeword with the website domain. Though it too has its issues (use

SuperGenPass[1] seems to be a much better alternative to this, since it actually hashes your codeword with the website domain. Though it too has its issues (uses fast hash functions, running it as a bookmarklet is problematic too–better to run it offline). Still, completely agree with this: > I agree with the replies that this is an unlikely attack considering how passwords are typically compromised It's always going to be a trade-off. Ultimately any scheme that gets people to use better passwords, even if flawed, must still be an improvement over the alternative of post-it notes and birthdays... there's no such thing as perfect security, as we keep being told. [1] www.supergenpass.com