So far the answers have been for "If I as a user add '.p' the end of all my passwords on various sites".
So I'd like to tackle the other possibility the original question could mean: "If I as a system programmer add '.p' to the end of all my users' passwords"
What you're describing is called a "Pepper" - it's a application-specific snippet that's tacked onto the password before hashing.
So what does this get you?
- It prevents dictionary attacks (since the attacker wouldn't know that
every password has a specific string of characters appended to the
- It prevents a breach in another set of credentials from compromising
yours (since there's no way another system's Hash(Password) would
match your Hash(Password+AppSpecificPepper).
What does it not get you?
- It doesn't prevent one password being cracked from cascading to all
accounts with the same password, since Hash(Password+Pepper) would
match for all accounts with the same password.
So, when it's all said and done? Absolutely - add the '.p' (or a much longer secret string) to the end of users' passwords. It makes the passwords more secure than just the original 8 chars alone - worst case, the attacker manages to compromise the app and get the pepper, in which case you're only as bad off as if you hadn't used a pepper in the first place. But make sure to add a Salt as well, so you don't let an attacker compromise multiple accounts with a single password crack.