I use SuperGenPass with a strong master password. It's not perfect (a malicious website could use Ajax to fish for my master password on a sign-up form), but it gives me a single password to remember, different passwords for every site, and I can keep the HTML page that runs the hash function on my thumb drive and use it anywhere.
In order to solve this problem for myself I looked into SuperGenPass as well, and reimplemented it in Racket so I could understand what it's doing. Here are a few notes on that:
• It's based on MD5.
• It repeats the hash 10 times. Typical key strengthening functions will do at least 1000 iterations, and at least 10000 seems to be becoming more common.
• Each time it repeats the hash, the output is encoded with a variant of Base64.
• The implementation of Base64 is deliberately nonstandard. + and / are replaced with 9 and 8 in the output (respectively). It pads with A, not =. The point is presumably to avoid generating special characters that could be disallowed by some password systems. This actually seems like an unintentional benefit to me: while it theoretically increases the probability of a collision, it does make it slightly more difficult to recover the original passphrase from the hash, or so it seems to me. (Any cryptographers want to comment on this one?)
• Hashing is repeated until it generates a password that starts with a lowercase letter and contains at least one uppercase letter and at least one number. The first restriction must come from some actual site, but it hardly seems common enough to enforce.
The biggest risk is in a site fishing your master password, though their "mobile" version allows you to run it in a different window. All in all, I think the concept has promise, but the implementation could be significantly improved.
http://supergenpass.com/