I was thinking of using different and independent password for different websites, but not storing them in some password manager so I don't need to backup the passwords. I thought I could use some cryptographic technique to do this, and I come up with a script that do the following:

• User input a master password into the script.

• User input a name, or domain - whatsoever, into the script as site name.

• The script use PBKDF2 with HMAC (hashlib.pbkdf2_hmac in Python) to generate a key, using the master password as the password input and site name as salt, 250000 as the number of iterations and 8 bytes as the key length.

  Doing this currently take around 1 second on my computer.

• The resulting key is treated as a number, and is converted into base 75. Each resulting digit is then mapped to a character using the following array:

    0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz
  

• The script output the resulting string and that string is used as a password for that site.

There's three goal I want to achieve with this script:

1. Given the same master password and same site name, the script should output the same string and it is a good secure password to be used on website.
2. Given only the generated password and site name, it should be impossible for an attacker to compute the master password (At least it should take a long time if the master password is strong).
3. Given only the generated password and site name, it should also be impossible for an attacker to compute password for other site name.

My question is: is this a secure password generator? The master password I used is basically just like a password that this script will output.

My implementation of this can be found here.

I was thinking of using different and independent password for different websites, but not storing them in some password manager so I don't need to backup the passwords. I thought I could use some cryptographic technique to do this, and I come up with a script that do the following:

• User input a master password into the script.

• User input a name, or domain - whatsoever, into the script as site name.

• The script use PBKDF2 with HMAC (hashlib.pbkdf2_hmac in Python) to generate a key, using the master password as the password input and site name as salt, 250000 as the number of iterations and 8 bytes as the key length.

  Doing this currently takes around 1 second on my computer.

• The resulting key is treated as a number, and is converted into base 75. Each resulting digit is then mapped to a character using the following array:

    0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz
  

• The script output the resulting string and that string is used as a password for that site.

There's three goal I want to achieve with this script:

1. Given the same master password and same site name, the script should output the same string and it is a good secure password to be used on website.
2. Given only the generated password and site name, it should be impossible for an attacker to compute the master password (At least it should take a long time if the master password is strong).
3. Given only the generated password and site name, it should also be impossible for an attacker to compute password for other site name.

My question is: is this a secure password generator? The master password I used is basically just like a password that this script will output.

My implementation of this can be found here.