Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I use https://pwdhash.com algorithmic password generator. It is the sweet spot of more security without too much added frustration.

Usually I use the Chrome extension, but when that fails I built a more user friendly web interface: https://ph.leftium.com

To avoid having to change all my passwords at once when one password must be changed, I suffix my master password with a sequential suffix. In the worst case, the last few suffixes don't work and I use the service's password reset feature to update the password to the latest suffix.



Note that the algorithm used by pwdhash is very weak. It uses just one round of 1 round of HMAC-MD5. Not even a slow hash function.

See https://github.com/dannysu/hash0 for comparison of other similar sites that all have the same flaw and the reason I coded hash0 (no longer maintained though).


I've considered making a version of PwdHash that uses a stronger hash function (and I think my brother did make one)...

But to be honest, if a hacker specifically targets you, you will probably be compromised, no matter how strong a hash function you use. (They will probably just use one of the many other attack vectors.)

And there's that joke about two guys running from a bear. "I don't have to outrun the bear; I just have to outrun you"

PwdHash lets me have unique, non-trivial passwords for every site with minimal fuss. There will be probably lots of lower hanging fruit before hackers start targeting PwdHash-generated passwords.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: