Password manager is software, and all software is potentially vulnerable, given relative effort. A password manager is also one-for-many, means someone may spent enough effort to steal information because the gains will be multiple from many users.
Human logic pattern is more safe in my opinion as long as it is not obvious. My standard password plus site name is still a pattern choice but a very poor one. Smarter choices will allow you for non-recognizable texts without reveal the pattern easily:
- github = bmyMagic&458_ghkg
- exchange = emyMagic&458_ghke
- gooogle = emyMagic&458_ghkg
- facebook = kmyMagic&458_ghkf
- arandomsite = 23@ar_goeasy
- justasite = 23@ju_goeasy
- somestoreibuystuff = 23@so_goeasy
- apple = 23@ap_goeasy
- bank = gJc$k49k&ci4j65_4l@l@
- financeforme = gJg$f49f&gi4j65_12l@l@
I separate logins to 3 categories, Low, medium and high risk (many sites, social and banks-emails).
For the medium risk, I used standard
myMagic&458_ghk, then add the first letter of the site to the end and the last to the start.
For low risk, I use another standard the
23@_goeasy and add the first 2 letters after
For high risk I used the standard
gJ$49&i4j65_l@l@. Then I take first and last letter of site and add one letter. So for bank I get
k and make them
l. Then I put those letters before and after
&; but for
& I put last before and first after. Finally I add the length of the site name after
Seems complicated but it is not really much if you get used to. Just keep a hard copy on a paper about your 'encryption'. Also make sure you clearly categorize your logins so to know what formula to use to each. You can also categorize differently, like split letters to 3 parts and choose category by 1st letter.
No matter what, you remember method and not password and if one password is compromised no other accounts are vulnerable, likely.
This way you can always 'remember' an unlimited number of different passwords and login anywhere after ... years! You can also create new accounts without have to invent a new password each time, or use a standard one to remember.
Plus your passwords are never stored anywhere into the your device, as you can select 'No' to all automatic password saves. This is very safe. This limits hacking to keystrokes or clipboard readers only.