Suppose I have a master password to my password manager. It's more or less secure. Now I want to enhance it - e. g. add 5 more characters somewhere, replace some characters, but let's say 20 chars of original password remain the same. How secure is such approach comparing to inventing (and remembering) the brand-new password?
To a first approximation, your problem is one of entropy computation. Estimate the entropy of your first password then the entropy of your second one and compare the two. You should aim to have at least 128 bits of entropy. Zxcvbn is a good estimator. You can also do it by hand.
Compared to inventing a new one, do what's more convenient for you. However, if you reused this password in part or in totality elsewhere, you should definitively invent a new one for your password manager.
It depends on what you intend by secure.
If the previous password had never been compromised, even partially by someone looking over you shoulder to read some characters from it, its quality is still intrinsic, meaning that it only depends on the total length and the characters used in it - it is the entropy, as A. Hersean said.
On the other hand, if it has been compromised, the attacker that knows it could first try variations on it. And in that case the quality (entropy) is only given by the new or replaced characters, which is much less than in the first use case.
TL/DR: if you can be sure that nobody else had any knowledge of the old password, improving it is perfectly correct. But IMHO as you cannot be sure of that (if you were why would you need to change it?), it is better to use a brand-new one.
Iterative improvements of a password is weak if the adversary has access to any data which lets him validate older passwords.
For instance an old copy of your password storage can be decrypted using the old password. Once this password is known to the adversary he can try variations of that password to decrypt a newer version of the password storage.
Same methodology can be used if the attacker rather than a file encrypted using the password has access to a salted password hash.
So unless you can reliably wipe every copy of every file which could be used to validate your old password, then a new improved password based on the old password is not much more secure than the old password.
Ways in which an adversary could get access to such old files include:
- Backup copies
- Remapped sectors on a hard disk
- Spare sectors for wear leveling on an SSD