Seems like everyone build this scheme. Seriously, there are many browser plugins and websites implementing it, and almost all of them ignore research (I'm guilty too). Also, most of them use fast hash functions instead of proper password hashes.

Here's a quick analysis of pros and cons of password generators compared to password managers: http://crypto.stackexchange.com/a/5691/291

I used a password generator (my own) for a few years, and I'm happy to use a password manager now, which is safer and makes me avoid keeping certain information in my mind (e.g. if I already have an account on this website and what's my username for it).

That's a very popular scheme.

The major downside is that site saying "your password must [not] contain blah-blah-blah"/"be N to M characters long"/"may contain only digits" when the generated one just happens to not conform to such restriction. In my personal experience, one out of dozen sites tries to be smartass about the passwords, so the scheme is a PITA in the long run.

Without the increment you also can't rotate password, while with the increment you need to store the increment value (and if you do keep the notes and the master secret, why not just remember the password already?)

The password managers are more flexible than password generators, because they don't have such limitations.

I wrote my own hashing method [1] that given a correct spec for password restrictions would always generate a valid password. It does it by taking the hash in base64, then translating those a new set of base64 characters chosen to increase the likelihood of getting a valid password. If one generated is not valid, it then iterates until a valid one is found (by cycling the bits).

I have used this personally since I wrote it. Given the downsides, I agree that password managers are probably better for most people.

[1]: https://github.com/onionjake/doh

This has similar security properties to a salted password based key derivation scheme. Given the output, and assuming a function with effective preimage resistance, the best way to find the global password is brute force it by trying lots of master passwords. The security is a function of the forward difficulty of the KDF (in space and time) and the quality of the master password. Use the password 'password' and MD5 and you don't have much security except through obscurity. Use an 8 word diceware password and scypt and you are doing great security wise (assuming of course no implementation problems, a big assumption!)

https://oneshallpass.com/ does that plus has a bunch of other options. It's by the founder of OkCupid and Keybase.io

I assume that the "increment" is so that you can hash the password again in case the password needs to be changed. But how do you tie the increment to that particular password? Otherwise your increment would have to be global, and if one of your passwords gets compromised you would have to hash all 200 others again simply in order to keep the increment consistent.

http://masterpasswordapp.com/ has a pretty good implementation.

I had people tell me that this would have problems with entropy. I didn't fully understand that, though.