By typing the master password into the destination form, then replacing it, the master is potentially revealed to any target site that might use JS/AJAX to view the password before form submission. So, this is not helpful against the "one bad (or compromised) site steals my master password" threat.

If SuperGenPass were to pop its own window, calculate the site-specific complex password, then insert that into the form, it could probably be safe -- but would still need very careful design. (Once a bookmarklet starts interacting with a page, it might reveal its internal state to that page.)

I've been using PwdHash. It's basically the same thing, but it's a Firefox addon. It will automatically hash a password field with the domain if you start the password with "@@" or hit F2. It also has a bunch of guards to warn you if you're entering your password in a field that might be insecure.

https://www.pwdhash.com/

It constantly surprises me that supergenpass hasn't caught on more with geeks. It's a pretty elegant solution to a problem everyone has.

If you're worried about browser security, there's a command-line reimplementation in python that a friend and I wrote:

http://github.com/gfxmonk/supergenpass

Less convenient, but much less likely to leak your passwords via the browser...

1Password is quite good for the Mac: http://agilewebsolutions.com/products/1Password

It integrates well with Firefox & Safari, and will sync over wi-fi to an iPhone for an encrypted backup.

For Chrome users there's http://code.google.com/p/superchromepass/

Nice! This is pretty much exactly what I was looking for!