Hi! I am not a fan of using a password manager, because I'm old fashioned and think that the best possible security is keeping the password in your head. However, I am a fan of creating a unique, rule-based password.

What is a rule-based password?

A rule based password is a password comprised of: (1) a base password and (2) a set of logic rules that modify the base password for each unique website.

How do I create a rule-based password?

First, pick your base password. In this example, I'll use "Fi$h.net" as my base.

Second, create a rule that you and only you can know and remember. I like to create rules based on the domain name of the website I am visiting. For this example, let's suppose the rule is that you'll take the first two letters of the domain, put them in front of your base password, and then take the last vowel and put it at the end of your password.

So your password for reddit becomes: reFi$h.neti But your password for google would be: goFi$h.nete

You can make the rule as complicated as you want. For example, you could add a condition that the password will include a number in the middle of the base equivalent to the number of consonants in the domain name.

Your password for reddit is now: reFi$h.4neti Your password for google is now: goFi$h.3nete

What are the advantages of a rule-based password?

A rule-based password allows you to create a unique but memorable password for each and every website you visit. Instead of having to rely on a password manager (which requires you to trust others with your passwords), a written password book (which can be stolen) or a single "chairbatterychainhorse" type password, you can now use a unique password that only you have access to. And the best part is that the only thing you have to remember two things: (1) the base password and (2) your rule!

What are the disadvantages of a rule-based password?

While a rule-based password is more secure than re-using a password, it comes with some risks. First, if a dedicated hacker has two or more of your passwords, it is possible that the hacker could work backwards to figure out your rule. However, it is unlikely that you'd find this kind of dedication for any mass-attack type of hacker, because they are generally focused on the least time consuming targets (e.g. people who reuse passwords).

Because this method would require having at least two passwords to figure out the person's rule, and would require spending a significant amount of time working backwards to figure out the logic of the rule, it is not likely that anyone other than a dedicated stalker (that you happen to know in real life) and/or creepy significant with a keylogger other would be able to learn your rule.

Edits for more FAQs

How do you deal with a site that has weird special rules?

Generally, I try to use a base password and rule that would cover most password rules: something that's at least 8 characters, does not contain any reference to any username I have, contains numbers, an uppercase and a lowercase letter, and at least one special character. Occasionally, I run into websites that have their own special rules. For example, maybe Target won't allow special characters. If that's the case, I email myself Target's own rule -- the email might say something like: "subject: target; body: no special characters." I keep these emails in a special folder, and I never put my password or rule in the email -- just the site's requirements. That's usually enough to jog my memory on how the password should be different. Following my example above, Target's password becomes: taFiSh4nete. This requires additional memory, and won't work for folks with memory problems. That said, I tend to have terrible memory when it comes to names/places/etc. and I have yet to be unable to log into anything.

What happens if a site is compromised?

So another weird quirk is that I generally change my passwords once a year, because I'm a little paranoid. (Happy new password year!) Every year, I'll come up with a new base and rule. When a site is compromised, I'll change the password ahead of schedule to the new year's rule. I'll also send myself an email that says something like "Subject: target, body: compromised on 4/25/16; changed on 4/26/16" just as a reminder. If I have trouble logging in, I'll look at this email for guidance to help jog my memory. Again, do not put your password or base in the email.

Does the rule have to be about the domain name?

No, but that's generally the easiest. If you were particularly concerned about the rule being secure, you could make your rule about something else related to the product/service. For example, you could make a rule that also incorporates the colors of the company logo, the purpose of the site, how you feel when you visit, etc. So long as you can remember your own rule, what it incorporates is up to you.