it does not stretch and does not even use a serious hash (md5). it is also completely predictable how it builds its per-domain passwords. this will only work for very good master passwords. and even then it will disclose your master password after a while. (it doesn't help either that its example master password is 'snowflake'...)