I'm looking for a way of securely having passwords for different pages. Say I generate this password:


Then, for each site, I change a single character. It's a single, random position with a random character shift. Isn't it almost as secure as having a string half the length randomly generated, unpublished and not reused? Then I'd only have to remember the 1-64 character position + another number in my memory, instead of the whole password.

What pitfalls does this model have? I don't know how to measure the strength of this. I haven't used this model [yet], but I think it might be very useful for many people and situations, one being the case of a travel. The main problem I can see is a binary search can yield to, in average, 1/2 the strength of the whole thing (still kicking-ass strong).

To answer, please, consider that the position and shift are truly random. How much more secure is it if the original password is not published anywhere? Since I'm not specifically looking for security through obscurity, I'd like to know.

Note: I know about correct horse battery staple and using a password manager, I'd just like to know if this is actually strong since I don't have the expertise to judge myself.

1 Answer 1


It was vaguely strong until you published your mechanism. Now, if someone manages to get hold of your base password and a hash, they only need to try about 6500 passwords to crack it - i.e. ~100 printable characters per position, with ~65 positions.

Not only that, but it's clear that you "keyboard hammered" in order to generate the base password, which means there will be statistical correlations that make discovering the base easier.

If you're storing the base password in a secure manner, there's no reason why you can't just store a full set of unique passwords in a secure manner. Invest in a password manager such as KeePass and your life will be a lot easier. Heck, it's way easier to remember a single strong password than it is to remember a whole score of offsets and alterations!

  • So simple and still I had no idea... But it's truth so I'm accepting it. I use Firefox Master Password currently, but just thought about this and wanted to check. Thank you so much! Jul 22, 2013 at 0:04
  • Noting that if you can not secure the base password securely (as a password manage running on an internet connected device is arguably insecure) then a model like this allows remembering the full password. Nov 24, 2020 at 18:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.