When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password and the name of the service/website you use it for. This way your passwords don't have to be stored anywhere since they are generated every time you enter your master password in the app. I liked this concept but I wanted to try making my own app for this.

So what I thought of is basically:

  1. get master password and service url from the user (example: "hello" and "accounts.google.com")
  2. add the strings together (ex: "helloaccounts.google.com")
  3. create a hash of this string using SHA-512 (ex: "86c594efe94db6fa07383a1d95866ef56cbeea39aec55010ca98519f5c052dc89181bce88c7308618334aff1ef345fbd7fb3b14b085fcd930fc114caf1a88ab9")
  4. use this hash as the seed for a PRNG that generates the password (ex: "{.80)g$MzBCI#;|@7Fj=a?Dj^~9x@CrV")

Here is a simple python script of that:

import hashlib
from random import randint, seed

hashGen = hashlib.sha512()

master = input('master: ')
service = input('service: ')

hashGen.update((master + service).encode())
hash = hashGen.hexdigest()
print('hash:', hash)

password = ''
for i in range(32):
    password += chr(randint(33, 126))
#(characters that are not allowed for some passwords will be removed from here later)

print('password:', password)

Now my question: If you use a good master password, would there be any security risks concerning this concept?

(Btw I also thought of using PBKDF2 or bcrypt instead of SHA-512 when I figure out how to use it. Would that improve the security significantly?)


This password manager have the downsides of making formulas for creating passwords, and lacks the flexibility of a proper password manager.

The most obvious issue is that the passwords are deterministic. It means that if you come across a website that forces you to use exact one digit on the password, you cannot use your password manager to generate it, as you don't control any aspect of the generation process.

The second issue is that you cannot easily rotate passwords. If any of the passwords leaks or expires, you will have to code workarounds for each one.

The last one is that the master password cannot be changed, or it invalidates every single password you have. You have to change every password on every site, and that is bothersome, to say the least.

What could you do? For an experiment, not for real: create passwords using random generator (may it be chars, words, or a mix), encrypt them using a symmetric key, and use the master password to encrypt the symmetric key.

This way you can change any password at will, and encrypt just the changed password. You can change the master password by decrypting the current symmetric key, generating a new master password, encrypting the symmetric key with it, and saving it back.

But unless you are a very talented programmer with a broad knowledge on cryptography and secure programming, don't write a password manager that will be used by anyone but yourself.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.