This online version shouldn’t need to transmit anything over the Internet in order to generate the password for any of your websites.
That statement is not correct (of course, depending on the software that you rely on to hash the password.) PwdHash.com requires user input from the browser to the server. Thankfully, pwdhash.com uses HTTPS encryption to the server.
But, you are sending your plaintext master password to the server. So, always be sure that the server you are connecting to is secure, first.
I actually thought of this method several months back, and wrote a single small password hasher script in Php to take user input, hash it is md5 and then in sha1. My script was more for generating random passwords in a rememberable format. I gave the option to specify a character limit, and then alphabetically sort the characters in the limit to make the new password.
It's a single file, so it's nothing fancy. (Unfortunately, I don't have it up on the web anywhere, since nathangrubb took down my userspace at grubbn.org...)
I actually have been using this concept to generate my new passwords, because if I ever forget the password (unlikely, but still a risk factor) I have a method to rehash it from the phrases that I hash.
<?php
/**
* Project: PassGen
* Author: Dr Small <drsmall@mycroftserver.homelinux.org>
* Creation Date: Day 019, 2009
* Description: Generates Hash passwords based on input.
*/
// Define a few variables for starting.
$length = $_POST[length];
$word = $_POST[word];
$show = $_GET[show];
// Return the default, top part of the page.
echo
'<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>PassGen - Password Generator</title>
<style type="text/css">
body { padding: 10px 5% 10px 5%; margin: 0px;}
table { border: 1px solid #3d3d3d; width: 100%; background-color: #c4c4c4; }
td { padding: 5px; text-align: left; font-size: xx-large; color: #000000;}
td.about { padding: 5px; text-align: left; font-size: medium; color: #000000;}
td.hide { color: #c4c4c4; text-align: center;}
td.hide:hover { color: #000000; text-align: center;}
div { text-align: left; font-size: xx-large; }
input { font-size: x-large; }
input.hide { color: #FFFFFF; }
input.hide:hover { color: #000000; }
select { font-size: x-large; }
</style>
</head>
<body>
<form action="'.$_SERVER[PHP_SELF].'" method="post">
<div>
<br />
Password Generator:
<table>
<tr>
<td>String: </td><td><input class="hide" type="text" name="word" value="'.$word.'"/></td>
<tr></tr>
<td>Length: </td><td><select name="length">'."\n";
$stoplimit = "41";
$startlimit = "5";
$currentlimit = '5';
// The while loop starts at 5 and ends at 40
// And since $currentlimit gets increaded by 1 after
// the text has been echoed, we make the stop limit 1 greater.
while($currentlimit == $startlimit or $currentlimit > $startlimit && $currentlimit < $stoplimit){
if($currentlimit == $length){
echo ' <option value='.$currentlimit.' selected="selected">'.$currentlimit.'</option>'."\n";
} else {
echo ' <option value='.$currentlimit.'>'.$currentlimit.'</option>'."\n";
}
$currentlimit++;
}
echo '
</select></td>
<tr></tr>
<td></td><td><input type="submit" value="Generate" /></td><td style="text-align: right; font-size: large;">[<a href="'.$_SERVER[PHP_SELF].'?show=about">ABOUT</a>]</td>
</tr>
</table>
</div>
</form>';
// If length of the string has been specified, proceed.
if($length){
// Hash the input string.
$md5hash = md5($word);
$shahash = sha1($md5hash);
// PHP4 COMPATIBILITY!!
if(! function_exists('str_split')){
function str_split($text, $split = 1){
$array = array();
for ($i = 0; $i < strlen($text);){
$array[] = substr($text, $i, $split);
$i += $split;
}
return $array;
}
}
// Split it up into single characters.
$chars = str_split($shahash, 1);
// Sort them numerically.
sort($chars, SORT_NUMERIC);
echo '
<div>
<br /><br /><br />
MD5 Hash:<br />
<table>
<tr>
<td class="hide">'.$md5hash.'</td>
</tr>
</table>
SHA1 Hash:<br />
<table>
<tr>
<td class="hide">'.$shahash.'</td>
</tr>
</table>
<br /><br />
New Password:<br />
<table>
<tr>
<td class="hide">';
// Return each character from the $chars
// array on the page.
$limit = '0';
foreach($chars as $char){
if($limit < $length){
echo $char;
$limit++;
}
}
echo '</td>
</tr>
</table>
</div>
</body>
</html>';
// Take the contents of the wastecan and dump them in the fire. :)
// First, we set each variable to a specific value to overwrite
// the previous contents, then we unset the variables for extra
// security. I don't take any chances.
$word = '001011110000001000000001';
$length = '001000010000001000000001';
$md5hash = '001011110000001000000001';
$shahash = '001011110000001000000001';
unset($word, $length, $md5hash, $shahash);
foreach($chars as $key => $char){
$chars[$key] = '0001000010000001000000001';
unset($chars[$key]);
}
// Define a seperate page.
} elseif($show == "about"){
echo '
<div>
<br /><br /><br />
About<br />
<table>
<tr>
<td class="about">
This password generator takes the input from a word, string
or poem, takes that input and makes a md5 hash out of it. This
hash is then outputted in the MD5 Sum table. Next, the password
generator takes the MD5 Sum and runs it through the SHA1 hash
function to generate a SHA1 hash off of the MD5 Hash.<br />
<br />
Next, based upon your selection of password length, the generator
outputs the first x amount of characters in the New Password table.
<br /><br />
At first glance, you will notice that the tables contain no visible
text. Simply hover your mouse over the table and the hash/password
will appear. This should keep people from looking over your shoulder
at the newly created password hashes.<br /><br />
All string inputs are <em>not</em> recorded, as complete privacy
is our goal.
</td>
</tr>
</table>
<br /><br />
Disclaimer<br />
<table>
<tr>
<td class="about">
PassGen does not store any of your input strings, password
lengths, md5 hashes, sha1 hashes or sorted strings (passwords).
Instead, this program goes to great lengths to wipe all such data
from cache to verify your privacy.<br />
<br />
Passwords are a sensitive thing and should not be taken lightly.
Generating a long yet rememberable password is essential to your
security and privacy. The minimum length limit for generating a password
has been set to 5, as anything below that can most usually be
guessed/cracked within a short amount of time.<br /><br />
The creators of PassGen can not be held responsible if
the password you have chose can be or has been cracked. Such
a guarantee is impossible since technology advances and
users make mistakes.
</td>
</tr>
</table>
<br /><br />
Source<br />
<table>
<tr>
<td class="about">
PassGen is released under the [<a href="http://creativecommons.org/licenses/GPL/2.0/">GPL License</a>].
Feel free to use and distrubite this software.
You may download the single source file from [<a href="'.$_SERVER[PHP_SELF].'s">here</a>].
</td>
</tr>
</table>
</div>
</body>
</html>';
}
?>