I pepper my randomly generated passwords. For example, imagine you have a random string generated from your password manager. If the password manager’s database is breached or your master password is leaked somehow, the attackers have access to all of your information.
Now think of a word or acronym or something… Something simple (can be simpler than a normal password). When you add a login, save the generated string to the manager but use a combination of the string + unique word for the website login.
Let’s assume CHEESE is my pepper word.
The generated string: hjifd;39Vq$7}
Saved to password manager: hjifd;39Vq$7}
Submitted to website: CHEESEhjifd;39Vq$7}
Now even if the database is leaked my passwords are still mostly useless.
I do something similar (though less secure) for general purpose passwords; I have a couple of common “base” passwords that are decently secure that I commit to memory. Then for each website/service, I pick a pattern based on the name/url (maybe something like the first two and last three characters of the url), and append them to one of my “base” passwords, so each site gets a unique password, but I only have to remember a couple of them + the pattern
I pepper my randomly generated passwords. For example, imagine you have a random string generated from your password manager. If the password manager’s database is breached or your master password is leaked somehow, the attackers have access to all of your information.
Now think of a word or acronym or something… Something simple (can be simpler than a normal password). When you add a login, save the generated string to the manager but use a combination of the string + unique word for the website login.
Let’s assume CHEESE is my pepper word.
The generated string: hjifd;39Vq$7}
Saved to password manager: hjifd;39Vq$7}
Submitted to website: CHEESEhjifd;39Vq$7}
Now even if the database is leaked my passwords are still mostly useless.
deleted by creator
I do something similar (though less secure) for general purpose passwords; I have a couple of common “base” passwords that are decently secure that I commit to memory. Then for each website/service, I pick a pattern based on the name/url (maybe something like the first two and last three characters of the url), and append them to one of my “base” passwords, so each site gets a unique password, but I only have to remember a couple of them + the pattern