Yes, as @tlrobinson suggested me, I should use bcrypt instead of SHA1. At the time I created ypassword there weren't any bcrypt js code. There is one now, and this will be my next update.

In fact, I tried to port scrypt to js once. Reading the article about scrypt it felt not so hard to achieve. But I was afraid to introduce implementation error because some parameter aren't specified as clearly as I would have liked in the article.