3 ms·

Here's details of how the algorithm is implemented: https://ssl.masterpasswordapp.com/algorithm.html https://ssl.masterpasswordapp.com/algorithm.html

• wtbob 11y ago
  For low-security situations it looks good enough, but be aware that generating a password from full name + a memorable passphrase + site name + a counter is still pretty brute-forceable; the counter is presumably small (and hence adds little entropy), and American full names just add three fairly well-constrained words. Also, isn't the counter a bit of state? Is the idea that the user has to remember it, or does the app remember it for him?
  • rmurri 11y ago
    I believe that the use of scrypt is supposed to make this unbruteforceable.