I am considering creating an application that is able to work out a unique password for a site by hashing the url while using a secure master password as a salt (or technically pepper since it will always be the same?). I am incredibly inexperienced in the world of cryptology so if this is a stupid question then sorry for wasting your time (:

  • 1
    $\begingroup$ Turn it around and you can see this as a password hash where the password is used as input key material and the site is the salt. I would suggest this is the better way of looking at it. $\endgroup$
    – Maarten Bodewes
    Commented Nov 20, 2018 at 16:12

1 Answer 1


The aim of using salt is having a countermeasure against the Rainbow tables. In your case, we can think of as you are creating a password for each site by using a master password and the URL of the site as salt.

Normally, you will be secure against the rainbow tables. One, however, must consider the case that the master password is compromised. Then all of the sites are easily compromised since your URL is known and the hash algorithm is also known.

A better solution, first, use an off-line system to generate the password for each site using a KDF function ( as Bcrypt, Argon2, PBKDF2) using your master password. For the randomness in KDFs you can use the URL but add other random values, too. Now, save your master password as offline, or delete if you finished.

Then you can use these passwords directly. And, remember you will still need the salt and pepper in your websites against rainbow tables.

  • 3
    $\begingroup$ There has been a lot of discussion about such schemes. The fact that you still rely on one master password - that cannot be easily changed, the fact that you cannot change the used passwords for the sites easily and similar issues are major drawbacks of this scheme. Often it is better to simply use a protected / encrypted password database - preferably on a different device. $\endgroup$
    – Maarten Bodewes
    Commented Nov 20, 2018 at 16:15
  • $\begingroup$ @MaartenBodewes I agree with you about relying on a master, it is like endless rely. I would still prefer to use the password database as an off-line system. $\endgroup$
    – kelalaka
    Commented Nov 20, 2018 at 16:54
  • $\begingroup$ Thank you very much for your answer kelalaka and for your comments @MaartenBodewes. The reason I want to use a system such as this one is because there is no chance of loosing the passwords if I loose the device they are stored on and they do not need to be synced between devices since the password application on any device will be able to determine the password given my master password. Additionally if the devices I use to obtain the passwords are out of charge and I am on a public computer I would still be able to obtain the password. $\endgroup$ Commented Nov 20, 2018 at 17:01
  • $\begingroup$ @HenryHoweson It is not a good idea to use a public computer to manage your sites. $\endgroup$
    – kelalaka
    Commented Nov 20, 2018 at 17:10
  • $\begingroup$ You cannot be sure that their computers are not infected with a key logger. $\endgroup$
    – kelalaka
    Commented Nov 20, 2018 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.