I'm sorry. I thought you mean Javascript challenge-response, which is a very common and very evil suggestion as a way to get SSL-like security without having to do SSL.<p>You mean things like 1password. That's fine. I use Keychain and head /dev/random | md5 for any password I don't have to remember.