With my latest password overhaul I switched to the master password system, not requiring any compromisable database of passwords as with password managers:
There also is a counter used for hashing. So for a new password you just increment the counter. Remembering the counter for every site sounds too complicated, but you could store that in a file without losing much (any?) protection.
Wouldn't you want to maybe... encrypt that file? Seems almost circular unless you use something like stenography to embed the data somewhere. I'm not personally too thrilled by a counter file to replace a different file, at that point I feel like I'm losing features.
Yeah, but then you need to carry the file with you, opening it (especially on mobile) is super clunky, and when you get to a site that doesn't support numbers/letters/whatever that the generator uses, it's hell. I used to use that, but I switched to KeePass2 and it's much better.
Note that the algorithm/app I mentioned does use the salt mentioned at the end as a possible solution. The counter problem is still there, but I don't feel it is a big issue.
How does that work with stuff such as odd password complexity rules (such as only digits allowed), enforced rotation, leaked password etc? It sounds like it would need to store more state than a master password.
From the same (master password, site identifier) combination you can generate the most common passwords. The app has categories short, medium, long, max, PIN (4 digits), phrase.
There also is a counter used for hashing. So for a new password you just increment the counter. Remembering the counter for every site sounds too complicated, but you could store that in a file without losing much (any?) protection.
http://masterpasswordapp.com/
You can even implement the algorithm yourself if you don't trust the app (which does not require any permissions on Android).