ShadowPWD: practical browser-based password manager with a security token

Password leak will lead a huge risk to users, especially when the same password is used for different Web sites. The ideal solution is setting the unique password for each Web site, but how to manage these passwords brings the huge trouble for users. Although some password managers have been produced, none of them are adequate enough. Considering the security and usability, we propose the ShadowPWD, a Web browser-based password manager with the following contributions: 1) it provides an isolated password input environment which can prevent password from being stolen by malicious application code; 2) it provides different passwords for different Web sites; 3) it chooses U-disk as a security token to further enhance the security, which is inexpensive and convenient for user to carry. We evaluate the efficiency of ShadowPWD and show that it is practical for the low overhead.