Since password managers are big and complicated and I currently am pretty bored since I am sitting in a car for a few hours, here is a simple algorithm to generate resource-specific, unique passwords using a master password and no password database.
It is 00:23 local time and I spent the part of the last night that I slept on a couch with loud music playing, so I would recommend you not to rely on my brilliant mind to produce a cryptographically secure algorithm at this time. I would, however, appreciate any comments and especially improvements of this algorithm. The first person to find a flaw has the honor to name the algorithm.
Simply paste the following line into a shell, type your master password (correctly, please, for there are no safeguards in place to protect you from typos) and press [enter] [ctrl-d] and you will be provided with a secure password specific for www.example.com.
(sha512sum ~/.salt -<<<www.example.com;sha512sum -)|cut -d\ -f1|sha512sum|cut -c-32Please not that this line will produce the same password every time you invoke it, provided that nobody messed around in your .salt file and you still remember your master password.
The salt can be pretty much any immutable file (i.e. .jpg and other files which tend to be modified by programs because of stored metadata are a really bad idea), as long as it is more or less unique. I generated mine with the following command line:
(dmesg;env;head -c16 /dev/random)|sha512sum>>~/.salt; chmod 400 ~/.saltUnder certain circumstances, this line may take a few seconds while /dev/random gathers entropy.
The password generate takes hex sha512-hashes of your salt file, your master password and the resource name you wish to generate a password for (i.e. e.g. a domain name), concatenates them one per line, hashes the result and takes the first 32 characters of the result's hex value. The resulting value is dependant on each of the three variables and no one of the variables can be computed from it (these are properties of cryptographic hashes as sha-512 is one). Obviously, the process could be improved if you would find a portable way to encode the resulting hash in a charset consisting of more than 16 digits, for then the resulting password could be made significantly shorter than 32 characters without loosing any entropy compared to now.
The salt file generation takes your dmesg (system-specific), your env (user specific) and a few random bytes (random), concatenates and hashes them, and puts the hash's hex string into the salt file.