I am interested in creating a formula to create unique passwords for every website that I am going to use. These passwords should be easy to figure out (not necessarily remember) for me at any point in the future, but not be vulnerable to any form of reverse-engineering with today's technology: the formula shall remain secret forever.

The passwords of two different websites should not be closely related (somewhat loose definition) so that if one finds out the password of my account on StackExchange, the security of my e-mail account remains intact (even though the usernames are the same in both places).

The reason behind all this is that I want to prevent personal privacy/security issues overall, even though I personally am not a target of anyone's malpractice (yet).

Do not be mistaken: I have heard the legend of the password-manager, but however welcomed and appealing its services might be to others, I am not interested.

My questions/worries with the formula are these:

• I do not know if it actually is easy to make a non-reverse-engineerable formula. Let me give an example-formula and you tell me how hard it would be to figure it out:

• Let a = 1, b = 2, c = 3, etc. Note the value of the second letter of the name of the website (stackexchange would give `t = 20`), note the number of letters of the name of the website (stackexchange would give `13`). Combine these numbers (`2013`). Now write the original name but replace every letter with the one to the left of it on the QWERTY-keyboard and make sure the N:th letter is upper-case (N being the last digit in the numer of letters (in this case `3`) (stackexchange would give `arLxjwzxglbfw`). Combine these and you have your complete password (stackexchange would give `arLxjwzxglbfw2013`). If someone sees that my password on stackexchange is `arLxjwzxglbfw2013` and that my password on gmail is `fnluK135`, would he be able to figure out that my password on facebook is `dlxwViiJ18` even with the help of a computer, or is this virtually impossible?

• If the generated password is too short, is simply repeating it good enough? For example, the password for gmail would be `fnluK135` (very short). Is `fnluK135fnluK135` a much more secure password? (this isn't really protection against reverse engineering, but more against guessing)

• Note that this is a re-post of this question on crypto.se. – Mike Ounsworth Mar 2 '16 at 21:21
• The general concept of keeping an algorithm secret is usually regarded as a bad thing: see en.wikipedia.org/wiki/Kerckhoffs%27s_principle You'll also run into issues where sites have differing restrictions on passwords, resulting in exceptions: what if a site requires a symbol? What if a policy prevents sequential characters, but your formula produces them? Seems likely to happen eventually... – Matthew Mar 2 '16 at 21:23
• @Matthew: the requirements of the site vs. the output of the algorithm is a very good point. – WoJ Mar 2 '16 at 21:27
• – Matthew Mar 2 '16 at 21:42
• Perhaps you could provide a bit more technical detail to explain your stance on password managers? They are generally regarded as a very effective way to manage complex passwords. However if you have valid technical reasons to consider them unsuitable, this could be useful information to share. – user1751825 Mar 3 '16 at 0:12