Do this instead https://spectre.app/

How does one handle password rotation requirements?

Doesn't that make your passwords predictable? If you use the same secret for every domain and now if an attacker figures out your one secret then they would be able to find out all your passwords.

How is that different from any other scheme which uses a master password?

A master password is at least generating random passwords though and encrypting the passwords themselves. Let's say your master password gets compromised, but not the password database itself... then attackers would still have no way to access your other passwords. With the method being described, simply obtaining the "secret" makes other passwords known without even needing access to the password database itself.

What do you when a generated password doesn't meet a web site's requirements (on length, character classes etc)?

oh that's cool. what I do is similar except simpler, much so.

Append it where?

e.g. password to facebook would be:

facebook.com$293MyPasswordYouKnowIt!!123

password to gmail would be

mail.google.com$113MyPasswordYouKnowIt!!123

only annoying thing is that the passwords are long. I guess it's secure, though.

edit: see child post for clarification. I do something above for spammy sites, but for something like gmail I probably wouldn't do that.

That’s not secure at all.

Eventually, some website you use is going to get hacked. They’ll have stored passwords as plaintext. From there, anyone who wants to hack any of your accounts knows your password format. It’s going to be obvious to them that they just need to replace the domain.

how would they figure out the unique identifier? couldn't you say the same thing about using an arbitrarily unique password and then a password manager. if your password manager is hacked then they'd get the encrypted passwords for all sites you use along with all the personal information.

of course, you'll say, don't use a crappy password manager. and that's correct. same reason I use a separate format for sketchy sites.

for what it's worth my format isn't really as described, but it is similarly deterministic, but not visually so. the cipher is basic enough to do in your head but complicated enough that you wouldn't know from a glance

a real password example for your scrunity:

m0m2a2yiplagsosowgolredd1o2t3c!o!m2

steps:

m a i l g o o g l e d o t c o m

strategy

zip

secret

mypassword123!!

offset (publicly determinable)

0

unique: 2022

m0m2a2yiplagsosowgolredd1o2t3c!o!m2

i use a password manager so the long text generally is irrelevant. the main reason I do this is because I don't feel comfortable needing my password manager. I like being able to figure out my actual password completely independent of a phone or internet or app.

the strategy depends on how sensitive the app is (strategies include: zip, append, vowel-zip, no-vowel-zip, num-zip, all the same but with a reverse-offset). unique is usually something like when I joined, or something determinable from the site and my head.

all of this seems much more complicated than it is. once you understand you could calculate the password in your head in a couple seconds.

Pro tip: don’t boast about your password strategy with ~10 bits of entropy online. If I were to target you, you just gave me an edge for free.

It does reduce the search space for a brute force attempt. Depending on how short your identifier is. Also if two sites passwords are leaked it could make someone’s job a lot easier.

you're putting a lot of confidence in an effective password length of 3

you're thinking too much about the specific example and not the general point, but I edited the parent comment with an actual example

edit: oh, I did say append so I see why you'd think that. that's my bad. what I meant was include

By your example, your passwords are a set of fixed or knowable data, plus a unique identifier that in your examples is three characters long. Therefore knowing one of your passwords gives all except three characters of every other password, thus making your effective password length three characters (substitute the actual length of your unique identifier if it's more than three).

Possibly not even 3 characters; 3 numbers.

you're right - i have clarified what I actually do. however I do something similar with a different password for sites I deem unsafe, or spammy.

Sure, that's slightly better, but you're putting in quite a lot of effort for minimal reward - there still isn't much entropy here compared to the size of the password, and you're relying on security through obscurity (that no-one will work out your method). Password crackers on modern GPUs can chew through many millions of guesses per second so having such a significant leg up would likely make your strategy trivial to break.

Also plenty of perfectly respectable sites have been compromised in the past so your estimation about how safe the site is unfortunately doesn't help much.

I really think you'd be better off using long randomly-generated strings and keeping multiple backups of your password database. There are lots of options that don't put you in the hands of a third party. All (?) sites offer password reset facilities in case of emergency, and you could memorise your email account password so that you can always at least get into that.

the main goal for myself is to be able to have complicated passwords and remember them without a computer. the problem with all password managers is ultimately it must be possible to get them in plain text by design, so if someone gets that they get all of your passwords.

I’m confused how you worked 2022 into the password. Trying to deduce your algorithm.

This scheme as described is not secure, but with one more step it can be. Luckily, that step has already been automated:

https://www.lesspass.com/

Prior art: http://PasswordMaker.org also with apps, browser extensions, command line tools, and many forks.

How do you remember the unique identifier?

it's deterministic, but obviously I can't tell you the secret ;)

that being said there are a lot of things you could use. you could use information in the whois, you could use the birthdate of the founder of the site, etc.

personally I believe people should use the same password for all sites and then something similar to what I described. though I use a password manager, I do always feel nervous about the implementation leaking out details

This means that if a breach reveals more than one of your passwords, the pattern is easily recognized and you just made ALL your passwords extremely weak. Not a great idea.

this is true, yes. fwiw what I do is more complicated than an append. I'll edit it to say "include", which is more accurate.