No. There are ten other variables he would need for each account. They are:

• URL
• character set
• which of nine hash algorithms was used
• date counter (if any)
• username (if any)
• password length
• password prefix (if any)
• password suffix (if any)
• which of nine l33t-speak levels was used
• when l33t-speak was applied (if at all)

Probably the most interesting of these is character set because it gives you the flexibility to determine precisely which characters can and can't be included in generated passwords.

This is a common complaint heard about hashed-based password systems (for example, see page two of A Convenient Method for Securely Managing Passwords). The complaint simply doesn't hold water with PasswordMaker because PasswordMaker adds nine other variables not used in the traditional password=master+url formula. Those nine variables create an enormous search space which would take thousands of years to search, even using a distributed network of one million modern PCs. The nine variables are:

• character set
• which of nine hash algorithms was used
• date counter (if any)
• username (if any)
• password length
• password prefix (if any)
• password suffix (if any)
• which of nine l33t-speak levels was used
• when l33t-speak was applied (if at all)

Of course, the URLs of the sites must also be known since they are used in password calculation. Probably the most interesting of these variables is character set because it gives you the flexibility to determine precisely which characters can and can't be included in generated passwords.

Nowhere, unless you choose the option Store Master Password on disk and in memory (encrypted). If you choose this option, your master password is stored using 256-bit strong encryption in %ProfileDirectory%/passwordmaker.rdf. If you don't know where your profile directory is, look here. For further protection you can instruct your operating system to encrypt passwordmaker.rdf. Instructions on how to do this with Windows XP/2000/NT are here. Instructions for Mac OS/X Tiger are here.

Nowhere. The generated passwords are calculated on-the-fly as they are needed. The RAM used to store and calculate the generated passwords is proactively cleared to prevent passwords from being stored in a swap file/virtual memory/paging file.

Everything is stored in %ProfileDirectory%/passwordmaker.rdf. If you don't know where your profile directory is, look here.

Although you can read the source code to determine this for yourself, there's an easier way. Install a packet sniffer and use PasswordMaker to generate some passwords. You won't see any traffic to or from PasswordMaker -- ever. It never connects to the internet. Two popular packet sniffers are snort (for Unix/Linux/OSX) and ipInterceptor (for Windows). Both tools reveal *all* network traffic, not just HTTP.

Yes. You can take advantage of PasswordMaker's other features (such as form completion) while still choosing your own passwords. Simply create an account in Advanced Options, set the password prefix to your current password, password length to the length of your current password, and check Auto-populate username and password fields for sites that contain this URL. Note: password prefixes are saved to disk unencrypted. An upcoming version will have a better solution for passwords you don't want to change.

Keyloggers work by tracing every key typed on the keyboard. With PasswordMaker, you never type anything but your master password (and if you choose Store Master Password on disk and in memory (encrypted), you only type that once). The real passwords (generated ones) are never typed, so keyloggers never detect them!

Most phishing attacks occur when you navigate to a URL which appears to be that of a site that you trust, but actually is owned by an attacker. For example, you might navigate to http://www.bc1.lu/ instead of the Bank of Luxembourg's legimite URL, http://www.bcl.lu/. The only difference between these two URLs is the lower-case letter L (used by the legitimite site) and the number 1 (used by the deceptive site). The attacker's intent is to get you to enter your username/password credentials on his deceptive site. He can then use those credentials on the legitimite site to do nefarious things.

If you use PasswordMaker, you'll be safe and secure. This is because the password it generates is based on the URL to which you've navigated. The password generated at a deceptive site is completely different than the one generated at a legitimite site (because their URLs differ, even if by one character). You might still be fooled into thinking http://www.bc1.lu/ is the Bank of Luxembourg, but the attacker will get the wrong password if you use PasswordMaker.

Yes! Let's suppose you want a Yahoo! account to use the same password as a gMail account. Go to the Advanced Options dialog and create a new account. In the When URL Contains field, type yahoo.com. In the Use This URL field, type gMail.com. That's it!

Go to the Advanced Options dialog and create two new accounts. In the When URL Contains field, type gMail.com. In the Use This URL field, type gMail.com. In the Username field, type your username for one of your gMail logins. Follow the same steps for the second new account, using the other gMail username in the Username field. Now whenever a gMail.com password field is populated, PasswordMaker asks you which account to use.

Yes! Go to the Advanced Options dialog and create a new account. In the When URL Contains field, type mybank.com. In the Use This URL field, type mybank.com. In the Counter field, type any text (such as a date or number) that you wish to change over time. For instance, you could type June 2005. When July comes and the bank expires your password, simply change the Counter to July 2005. You might instead choose to use an incrementing number. For example, 1 for this month, 2 for the next month, etc. Any text that you enter in the Counter field will vary the password.

PasswordMaker has "Export Settings" and "Import Settings" options. Exporting the settings saves them to a file (with the option to include/exclude the master password in encrypted form), while importing settings takes a file and imports its contents as if you'd manually entered them. You can synchronize two or more PCs this way.

There are plans to optionally save this file on an FTP site so you don't need to transport it across PCs, but you can always opt-out of this. In the meantime, you can store exported settings centrally somewhere yourself (like your web-based email account) to make it easy to import them from anywhere.

You're out of luck.

Install the KeyConfig Extension. Scroll down to the PasswordMaker entry and change the shortcuts to anything you like. Changes won't take effect until you restart Firefox/Mozilla.

• MD4
• HMAC-MD4
• MD5
• HMAC-MD5
• SHA-1
• HMAC-SHA-1
• SHA-256
• SHA-256
• RIPEMD-160
• HMAC-RIPEMD-160

All of the algorithms are cryptographically strong, but of the algorithms PasswordMaker offers, many people regard SHA-256, HMAC-SHA1, and HMAC-MD5 as the strongest.

At Crypto 2004, Xiaoyun Wang, Dengguo Feng, Xuejia Lai and Hongbo Yu announced they had found hash collisions for MD4, MD5, RIPEMD, and HAVAL-128. SHA-1 hash collisions have also been announced. A hash collision means the researchers found two or more messages that yield the same hash with these algorithms. However, it's important to note that the one-way nature of these algorithms has not been undermined. In other words, in the context of PasswordMaker, hash collisions do not empower someone with the ability to derive your master password if they have your generated (hashed) passwords. The hash collision attacks have no relevance to PasswordMaker except there is very small chance someone could choose a different master password than yours which hashes to the same generated password. However, he would still need your username and the URL in order to hack your account.

Had the attacks been pre-image attacks, the risk to PasswordMaker would be more severe. However, there have not been any published pre-image attacks for these algorithms. Moreover, even if a pre-image attack did exist, the attacker would have to know which hash algorithm you used to generate the hashed password, as well as your username on the website in question and the website's URL before he could access your account.

If you are still hesitant, PasswordMaker supports SHA-256, HMAC-SHA-1, HMAC-MD5, and HMAC-MD4. Neither collisions nor pre-image attacks have been found for any of these algorithms to our knowledge. Once again, it's important to stress that hash collisions do not affect the one-way nature of the compromised algorithms and, therefore, do not affect the integrity of PasswordMaker.

If you've selected a non-HMAC hash function (those without the HMAC prefix), passwords are generated using the following pseudocode:

password = mp + usingURL + username + counter
password = leet(password, leetlevel)   [optional]
password = hash(password, charset)
password = leet(password, leetlevel)   [optional]
password = prefix + password + suffix
password = truncate(password, length)

If you've selected an HMAC hash function (those with the HMAC prefix), passwords are generated using the following pseudocode:

data = usingURL + username + counter
mp = leet(mp, leetlevel)   [optional]
data = leet(data, leetlevel)   [optional]
password = hmac_hash(mp, data, charset)
password = leet(password, leetlevel)   [optional]
password = prefix + password + suffix
truncate(password, length)

where + is the concatenation operator. mp is the master password, usingURL is the value in "Using URL", and username, counter, prefix, and suffix are optional settings specified in the Account Settings dialog. For HMAC hash functions, mp is the secret key and data is the input text.

The extension works with Firefox, Mozilla, and Netscape on Windows, Mac, and Linux/Unix. An Internet Explorer extension is currently being developed. The on-line version works with all browsers (including Internet Explorer and Opera) on all platforms. The desktop version (coming soon) is written in Java and works on Windows, Mac, and Linux/Unix. The J2ME version (also coming soon) works on any Java-enabled mobile phone or PDA.

You can turn it off (and back on again) by creating the new boolean preferences browser.toolbars.showbutton.passwordmaker and browser.toolbars.showbutton.passwordmaker-key in about:config or user.js with the value of true or false. Make sure to restart all browsers after making the change.

If you're using Firefox, it's quite simple. Select Tools -> Extensions, select PasswordMaker and click the Uninstall button.

If you're using Mozilla or Netscape, it's as simple as deleting two files and one directory:

• If you installed PasswordMaker to a profile, locate that profile's directory (read this if you don't know how to find it). If you installed PasswordMaker to the browser directory, locate your Mozilla or Netscape installation directory (read this if you don't know how to find it).If you don't know where you installed PasswordMaker, try to remember how you answered this prompt when installation began:
  
  The rest of these directions refer to the path you've identified as path.
• Delete the file /path/chrome.rdf. This file is automatically regenerated the next time you start Mozilla or Netscape.
• Delete the file /path/chrome/passwdmaker.jar
• Delete the directory /path/chrome/overlayinfo. This directory is automatically recreated the next time you start Mozilla or Netscape. If you restart and this directory hasn't been recreated, don't worry: it just means you don't have any other extensions, themes, or skins installed.

Yes! Free technical support is provided here. Response time is typically less than 24 hours.

This is the license agreement. There are no plans to charge money for PasswordMaker.

Right here!