I once started developing such a tool, but abandoned it when I understood the web browser is not a safe environment.

You can't trust the javascript you execute: http://www.matasano.com/articles/javascript-cryptography/

For another example, imagine a security breach on the server, some malicious javascript code injected server side, and your passwords get leaked, without you noticing.

If you think that you don't have to use SSL because you encrypt client side, think again. Without SSL a simple proxy can inject javascript in the page and get all your passwords.

The best solution I think, which I haven't had the time to implement yet, is a native app, retrieving only encrypted and signed data from the server.