It is important to note that there is a security flaw in this scheme that makes it strictly less secure than using a password manager with randomly generated passwords. All an adversary needs in order to generate all of your passwords is your master password. Let's walk through the steps of how an adversary can brute force your master password.
First, they will need access to a hash of one of the passwords you have generated. Say you use this application for every site you visit, and you have somewhere between 20-30 accounts. If only one of these companies suffers from a password leak, then the adversary will have enough information necessary to brute force your master password and generate your password for all other sites. This means that the sketchy site you created an account on to buy a phone case can result in an adversary gaining your well-protected bank password.
Once they have a password hash, they can brute force your master password in the regular way. All other inputs to password generation function are easily obtainable through minimal social engineering or guessing (your name, the site name, number of re-generations). I will note here that they did use scrypt, which makes brute-forcing more difficult (but not impossible). So, if you use a weak master password, not only is your password for the vulnerable site brute forceable, but all other sites you use in the present and the future will be compromised.
This scheme is not more secure than existing password management schemes (provided the password manager uses a good hashing algorithm for the master password like PBKDF2). It is strictly less secure because the security of all your passwords relies on the minimum security of all sites you use. It is also less secure because after a leak, an adversary can generate future passwords.
This tool should be used with caution and with these facts in mind.
First, they will need access to a hash of one of the passwords you have generated. Say you use this application for every site you visit, and you have somewhere between 20-30 accounts. If only one of these companies suffers from a password leak, then the adversary will have enough information necessary to brute force your master password and generate your password for all other sites. This means that the sketchy site you created an account on to buy a phone case can result in an adversary gaining your well-protected bank password.
Once they have a password hash, they can brute force your master password in the regular way. All other inputs to password generation function are easily obtainable through minimal social engineering or guessing (your name, the site name, number of re-generations). I will note here that they did use scrypt, which makes brute-forcing more difficult (but not impossible). So, if you use a weak master password, not only is your password for the vulnerable site brute forceable, but all other sites you use in the present and the future will be compromised.
This scheme is not more secure than existing password management schemes (provided the password manager uses a good hashing algorithm for the master password like PBKDF2). It is strictly less secure because the security of all your passwords relies on the minimum security of all sites you use. It is also less secure because after a leak, an adversary can generate future passwords.
This tool should be used with caution and with these facts in mind.