I am interested in creating a formula to create unique passwords for every website that I am going to use. These passwords should be easy to figure out (not necessarily remember) for me at any point in the future, but not be vulnerable to any form of reverse-engineering with today's technology: the formula shall remain secret forever.
The passwords of two different websites should not be closely related (somewhat loose definition) so that if one finds out the password of my account on StackExchange, the security of my e-mail account remains intact (even though the usernames are the same in both places).
The reason behind all this is that I want to prevent personal privacy/security issues overall, even though I personally am not a target of anyone's malpractice (yet).
Do not be mistaken: I have heard the legend of the password-manager, but however welcomed and appealing its services might be to others, I am not interested.
My questions/worries with the formula are these:
I do not know if it actually is easy to make a non-reverse-engineerable formula. Let me give an example-formula and you tell me how hard it would be to figure it out:
Let a = 1, b = 2, c = 3, etc. Note the value of the second letter of the name of the website (stackexchange would give
t = 20), note the number of letters of the name of the website (stackexchange would give
13). Combine these numbers (
2013). Now write the original name but replace every letter with the one to the left of it on the QWERTY-keyboard and make sure the N:th letter is upper-case (N being the last digit in the numer of letters (in this case
3) (stackexchange would give
arLxjwzxglbfw). Combine these and you have your complete password (stackexchange would give
arLxjwzxglbfw2013). If someone sees that my password on stackexchange is
arLxjwzxglbfw2013and that my password on gmail is
fnluK135, would he be able to figure out that my password on facebook is
dlxwViiJ18even with the help of a computer, or is this virtually impossible?
If the generated password is too short, is simply repeating it good enough? For example, the password for gmail would be
fnluK135(very short). Is
fnluK135fnluK135a much more secure password? (this isn't really protection against reverse engineering, but more against guessing)