SitePassword is a password manager that calculates your passwords instead of storing them. It also allows you to specify a password when you don't want to use the computed one.

This web page is a companion to the SitePassword browser extension. In addition to remembering your settings, the extension synchronizes them across your machines. You should use the extension if you are have a compatible browser. Unfortunately, browsers on mobile devices don't allow extensions.

The SitePassword web page is also available at https://alanhkarp.github.io/SitePasswordWeb/ .

SitePassword is different from most password managers. Instead of storing your passwords, it calculates them from a super password and a per account nickname and user name. That means you can usually get your account password if you remember those three things. (Some web pages require additional settings.) It also allows you to specify a password when you can't use the computed one.

You should choose a strong super password, one with upper and lower case letters, numbers, and special characters. The stronger the better. The reason is simple. A bad guy who knows one site password and can figure out your nickname and user name for that site can start guessing super passwords. You want to make that job has hard as you can.

You can protect yourself further by using different super passwords for different kinds of accounts. You could have one that you use for banking, another for subscriptions, and a third for sites you find sketchy.

SitePassword doesn't prevent you from using a weak super password, but it does warn you. There is a strength indicator directly above the super password field. The color of your super password corresponds to the level shown on the meter. For example, if your super password is green, it is strong. If it's orange, your super password is weak. The tooltip tells how long it would take a determined adversary to guess your password.

You'll notice that your super password is not usually marked Strong until it is longer than a account password marked Strong. That's because the super password is something you can remember, while the account password is effectively a random string of characters, which is less guessable.

SitePassword cannot retrieve your super password. You should make sure it's something you won't easily forget. You might even want to write it down and keep the copy in a secure place.

You refer to an account by its nickname. It can be easy to remember, such as amazon for amazon.com, but it doesn't have to be that simple. It is one of the things used to compute your account password.

Your settings, such as your user name, the account password length, and whether your account password contains special characters are associated with this nickname.

Some web sites have strict password rules, how long it must be, if it must contain upper case or lower case letters, numbers, or special characters, including restrictions on which special characters are allowed. If you run into a site that doesn't accept the calculated password, change the appropriate menu entries. SitePassword was tested on hundreds of web sites to make sure it can almost always compute a valid password.

You can also change the default values that SitePassword uses. For example, SitePassword defaults to a password with no special characters. You can change these defaults by clicking the Save as default option in the settings panel.

Some sites make you change your password periodically. SitePassword makes that easy. Just change your nickname for the account. For example, if your current nickname is MyBank1, and they make you change your password, you could change the nickname to MyBank2. Your new account password will be completely different from the old one.

SitePassword includes an antiphishing feature. If you try to use the nickname of an account that you previously had clicked Remember for another domain name, you will get a big, scary warning. It's telling you that you may be at a site spoofing the one you think you are at.

Unfortunately, you will also see this warning when you are not being tricked. Many websites have several different login pages with different domain names. So, when you see the warning, check the URL of the page to make sure it's a login page for the account you think it is.

The SitePassword extension plays well with this page. In particular, the extension uses bookmarks to synchronize your settings across machines. Pasting the appropriate bookmark into the bookmark field on this page fills in the form for you. You can also click on the bookmark to open this page with the form filled in for you.

If the domain name of the URL you pasted does not match that of the bookmark you selected, you'll get a phishing warning. It's telling you that you may be at a site spoofing the one you think you are at.

You can calculate your password without providing a domain name, say to get the password for an app on your mobile device, but you won't be able to remember the settings until you provide a domain name. You can just make one up, e.g., https://MyApp.com, which you'll use the next time you need the password for that app.

There is a Download local data button near the bottom of the Settings panel. That button lets you save your settings to a file you can reference if you're at a machine that doesn't have your SitePassword settings. Only settings for accounts you've chosen to remember on this machine will be included.

Reports of bugs, problems, and suggetions for improvements are welcome. You can use the project page, Issues.

If you are worried that SitePassword might go away, you can download the source code for the extension from the SitePassword project and that of this page from the SitePasswordWeb project. (For historical reasons, these are separate projects with a lot of duplicated code.)

If you like SitePassword, please make a contribution to the Nancy Lee Hurtt '70 Maryland Promise Scholarship or your favorite charity.

• Alan Karp is the princple culprit. He stared with a very simple password calculator in 2002 that he turned into a Chrome extension in 2012. What you see today is the result of many improvements over the years, a lot of them suggested by the other contributors. Don't blame anyone else for bugs or usablity problems, but do credit them with the improvements they suggested. Please send any feedback to alanhkarp@gmail.com.
• Doug Crockford provided useful suggestions for improvements, many of which were resisted but make SitePassword much better, both in terms of functionality and usability. Two features stand out: the ability to provide your own account password and the Forget menu option. The look and feel is much improved due to Doug's constant nitpicking of seeminly minor details. That kind of feedback is almost impossible to get even if you offer to pay. Getting that kind of feedback for free is rare.
• Dale Schumacker wrote most of the code for this web page and made many useful suggestions. His code has been changed enough that he is not responsible for any issues, but he deserves kudos for its overall design. As an early user of SitePassword, Dale provide critical feedback.
• Michael Josefik provided the professional design for this web page. He showed remarkable patience as his ideas were resisted but then implemented when he was proven right.
• Important security improvements came from the people at the Stanford Security Lunch. They did not do anything approaching a security review and are not responsible for any vulnerabilities.