I use the HMAC hash of the username, the site, and a ‘key’ generated at random. However, this does mean that I'm screwed if I cannot access the keys [and cannot remember the password].