Password composition algorithm

Question

I'm sick of remembering all the passwords for different logins. Lately I found the interesting tool password composer which lets you generate passwords base on the hostname and a secret master password. But I don't want to use a website or installing software to generate my passwords.

So I'm looking for a simple one way hashing alogorithm which I can execute without computer aid to generate my passwords. Something in the spirit of the solitare cipher without the need for cards.

Using a PW store is not an option.

Answer 1

Why don't you just use the exact same algorithm as the password composer?

• Pick a master password
• Take the application/machine name for which you want a password
• Concatenate the two (or shuffle)
• Apply a code you can do in your head, like Caesar's cipher
• Take the first X characters (15 is usually a good length for secure passwords)

Example:

Master Password: kaboom
Machine Name: hal9000
Shuffle: khaablo9o0m00
Transposition table: shift 5 left
abcdefghijklmnopqrstuvwxyz 1234567890
vwxyzabcdefghijklmnopqrstu 6789012345 

Result: fcvvwgj4j5h55

You could use as complex a substitution as your head can do reliably (with or without a paper). You could also use a different table for each password (say, deduce the table from the first letter of each machine name). As long as your master password is secure, there's nothing to fear about the simplicity of the algorithm.

Answer 2

Something I used to do (before I started using pwgen to generate my passwords) was to find a nearby paper document and use the first and last character of each line. So long as you know which document goes with which account, regenerating the password is easy if you lose/forget it and no computer is required to do so. (It is important to use a book or other paper document for this, of course, as anything electronic could change and then you'd be lost.)

Answer 3

First pick a person (celebrity, relative, fictional character or whatever). This person's identity is your private key, which you should keep secret.

To generate a password for a site, juxtapose the person with the sitename and think about the two for a while. Whatever mental image you get, sum it up with a memorable phrase and take a moment to fix the image and the phrase in your mind. The phrase is your password for this site.

(edit) The rationale for this method is that any maths-based system would be either insecure, or too complicated to do in your head.

Answer 4

Alternate characters of the hostname with characters from your master password until you run out of master password characters.

hostname: stackoverflow.com master password: homer

new password: shtoamcekro

I can almost do that in my head. No need for paper or pencil.

Don't use this system for anything super important. But for your half dozen email, facebook and other random accounts it should be fine.