I was reading about PwdHash and it inspired me to create a little project where you input a master password and an easy to remember alias into a password hash, like bcrypt, and then you get an hash.
So far so good ; that hash should be pretty secure and no one should be able to guess my master password from it.
The problem is that this hash is not really a usable password. For example, website have all sort of requirements for password like not more than 20 characters, must contain symbol, number, lower case letter and upper case letter, must not start with a number, etc...
So : hash + requirements = usable password
But I have a concern. Is it possible that by applying the requirements to the hash in order to produce a usable password, I will lose some of the security that the hash produce?
For example, let's say the hash is 60 characters long and the password cannot have more than 20 characters. Is it bad to only take the 20 first characters of the hash? Would it be better to produce the 20 characters of the password combining together the 60 characters of the hash?
So the general question is :
How should I proceed to create a usable password from that hash? Do I have to worry?