@Daniel Crowley You are correct, there are sites that do store usernames and passwords in plain text who are not labeled as "Evil", however IMO they should have a badge displayed that says "inexperienced and naive". I recently visited a well known site and happened to look up into the address bar only to see both exposed in plain text!!! As @Rob Lawrence pointed out, there should be some quality control particularly for the safety and security of the general, global public. It is simply the responsible and honorable thing to do. Though, as @Richie stated those who use this plug-in may "deserve what they get" (only due to its own title), do the site's visitors and general public who unwittingly submit to the use of this plug-in deserve what they get? This falls into the category of "reasonable expectations" don't you think? And yes, by @Ipstenu definition and explanation of "legitimate", in the dev environment for testing for security vulnerabilities I can see his point, but never under the excuse of boredom and certainly not ever in a production environment. @squalyl's solution is at least considering the implementation of a developer's or site-builder's own responsibility to the general public's safety and privacy. Years ago I developed my own personal "salting" method due to some sensitive software packages for a client that required a higher level of security. Our responsibility is to the general public and end-user as well as the clients who will have their own pool of end-users. It is a very sad day that we live in to see that people like this have a place online that accepts anything from anyone without any type of quality control especially something that becomes associated with and affects their own reputation.