I use a password manager, I vary the length of my passwords occasionally and they're all unique and random but I think - what if the PW database leaks (e.g., malicious software exfiltrates the contents)? Not all sites support 2FA so how can I increase security?
I came up with an idea. I decided to type a word at the start before I autotype the long random password. The word is always the same for every account in this "important" category and the word only exists in my head. The idea is if the database leaks then no one can get in to my most important accounts because they don't know the word.
This is a sort of 2FA without the need for website support. If multiple important credentials were to leak it would be obvious what I was doing and you could assume there were other passwords that I use with this word at the beginning. I assume this decreases entropy. In what scenarios would my system be less secure, if any? Could knowledge of my secret word from one leaked credential (e.g. from a website breach) help you crack another of my accounts beyond the obvious benefit of knowing e.g., 5 of my 25 chars? Am I better off not doing this for some cryptographic reason or is it a sensible extra precaution against a database leak?
After seeing some answers, more concisely, could knowledge of [staticWord]'s existence / content / position, help you crack "[longRandomString][staticWord]" or is it always at least as strong as [longRandomString]?
Just thinking through this, is there a possibility an attacker may not know they've cracked a password if it's a random string, until it's tested to see if it works. Whereas you could assume it's cracked if you decrypted a random looking string and noticed a real word at the end of it. I don't know whether this could/would happen. I think my staticWord should be short and random.