how would they figure out the unique identifier? couldn't you say the same thing about using an arbitrarily unique password and then a password manager. if your password manager is hacked then they'd get the encrypted passwords for all sites you use along with all the personal information.

of course, you'll say, don't use a crappy password manager. and that's correct. same reason I use a separate format for sketchy sites.

for what it's worth my format isn't really as described, but it is similarly deterministic, but not visually so. the cipher is basic enough to do in your head but complicated enough that you wouldn't know from a glance

a real password example for your scrunity:

m0m2a2yiplagsosowgolredd1o2t3c!o!m2

steps:

m a i l g o o g l e d o t c o m

strategy

zip

secret

mypassword123!!

offset (publicly determinable)

0

unique: 2022

m0m2a2yiplagsosowgolredd1o2t3c!o!m2

i use a password manager so the long text generally is irrelevant. the main reason I do this is because I don't feel comfortable needing my password manager. I like being able to figure out my actual password completely independent of a phone or internet or app.

the strategy depends on how sensitive the app is (strategies include: zip, append, vowel-zip, no-vowel-zip, num-zip, all the same but with a reverse-offset). unique is usually something like when I joined, or something determinable from the site and my head.

all of this seems much more complicated than it is. once you understand you could calculate the password in your head in a couple seconds.

Pro tip: don’t boast about your password strategy with ~10 bits of entropy online. If I were to target you, you just gave me an edge for free.

It does reduce the search space for a brute force attempt. Depending on how short your identifier is. Also if two sites passwords are leaked it could make someone’s job a lot easier.

you're putting a lot of confidence in an effective password length of 3

you're thinking too much about the specific example and not the general point, but I edited the parent comment with an actual example

edit: oh, I did say append so I see why you'd think that. that's my bad. what I meant was include

By your example, your passwords are a set of fixed or knowable data, plus a unique identifier that in your examples is three characters long. Therefore knowing one of your passwords gives all except three characters of every other password, thus making your effective password length three characters (substitute the actual length of your unique identifier if it's more than three).

Possibly not even 3 characters; 3 numbers.

you're right - i have clarified what I actually do. however I do something similar with a different password for sites I deem unsafe, or spammy.

Sure, that's slightly better, but you're putting in quite a lot of effort for minimal reward - there still isn't much entropy here compared to the size of the password, and you're relying on security through obscurity (that no-one will work out your method). Password crackers on modern GPUs can chew through many millions of guesses per second so having such a significant leg up would likely make your strategy trivial to break.

Also plenty of perfectly respectable sites have been compromised in the past so your estimation about how safe the site is unfortunately doesn't help much.

I really think you'd be better off using long randomly-generated strings and keeping multiple backups of your password database. There are lots of options that don't put you in the hands of a third party. All (?) sites offer password reset facilities in case of emergency, and you could memorise your email account password so that you can always at least get into that.

the main goal for myself is to be able to have complicated passwords and remember them without a computer. the problem with all password managers is ultimately it must be possible to get them in plain text by design, so if someone gets that they get all of your passwords.

I’m confused how you worked 2022 into the password. Trying to deduce your algorithm.