Depends on your "cipher."
If the cipher results in a search space that is as large as the search space required for brute force, your scheme is 100% effective.
To explain this, let's use a trivial example. Assume there is a very poor web site that requires a four-digit alphabetical password.
The brute force search space is 26^4 = 456976.
Meanwhile, there are only about 4000 four-letter words, so the default dictionary attack search space is only 4000. Very bad.
Now let's say you use a very simple transformation: take each letter and add one, so A become B, B becomes C, etc. In order to search the dictionary and this simple transformation, the attacker must now search a namespace containing 8,000 entries. This is a bit better.
Now, the attacker won't know you are adding one. He may suspect it. But he may also need to check +2, -1, and -2. That's four transformations totalling 16,000 sequences. Still poor, but better than 4,000.
Now, there are probably a lot of possible transformations you could come up with that you could do in your head. Shift your hands one key to the right and touch type. One key left. Type the word backwards. Swap vowels and consonants. Etc, etc. If there are 100 transformations, now the attacker has to search 400,000 possible sequences. Hey this is looking pretty good.
At some point the attacker is going to give up looking for novel transformations because it will result in a search space greater than that required for brute force, 456976. The moment that happens, your scheme is 100% effective.
If you really want to make it secure
If you really want to make it secure, introduce a secret. For example, memorize a poem, then map each letter of alphabet to a line in that poem, and substitute the first letter of the line for each letter. If the attacker doesn't know the poem, he will have a helluva time writing a program to guess it. Unless he reads the same literature as you he may never figure it out. Now perhaps a clever hacker out there will introduce a poem database into his search algorithm, but in the end it is going to end up being more computationally expensive than a plain brute force attack.
If you're made the dictionary attack more expensive than a brute force attack, the hacker will use a brute force attack. That is best case scenario, since there is no way for an end user to mitigate brute force through choice of password.