Build Your Own Mental Passphrase Algorithm
A single passphrase used everywhere is still a single point of failure — leak it once, and every account behind it is exposed. The fix that professionals recommend is a password manager with a unique random passphrase per site. But if you want something you can compute in your head, with nothing written down anywhere, you can build a personal algorithm that turns a base phrase you already know into a different passphrase for every site — derived from something about the site itself, like its URL.
The idea: keep a memorized base (a few unrelated words, per the earlier post), then apply a private, repeatable transformation keyed off the site you're logging into. The transformation must live only in your head. The moment it's written down, shared, or guessed from a pattern in your leaked passwords, it stops doing its job.
The core structure
Most workable schemes have three parts:
A fixed base — 2–3 unrelated words you've already memorized
ledger thunder pocket
A site-derived element — something computed from the site's name or URL, different for every domain.
A fixed personal rule glueing them together — the order, spacing, or transformation that only you know.
The site-derived element is what makes each passphrase unique. The trick is choosing a rule that's easy for you to compute in a few seconds but doesn't produce an obvious, guessable pattern to anyone who might see one or two of your passphrases and try to reverse-engineer the rest.
Example algorithms
Letter-count word substitution. Keep a private mental list of 26 words, one per letter of the alphabet (like a phonetic alphabet, but yours alone — never Alpha/Bravo/Charlie, since that's public). Take the first letter of the site's domain name and swap in your word for that letter as a fourth word in your phrase.
amazon.com
→ first letter A → your private "A word" →
ledger thunder pocket [A-word]
chase.com
→ first letter C → your private "C word" →
ledger thunder pocket [C-word]
Vowel-count positioning. Count the vowels in the site name and use that number to decide where in your base phrase you insert a fixed site-category word.
github
has 2 vowels → insert your "dev-sites" tag word in position 2 of your phrase.
netflix
has 2 vowels also, but if you further distinguish by category (streaming vs. dev tools), the resulting phrase still differs because the inserted tag word differs.
Length-based number append. Count the letters in the domain name (excluding the extension) and append that number, spelled out as a word, to your base phrase.
ebay
= 4 letters → append "four" →
ledger thunder pocket four
wikipedia
= 9 letters → append "nine" →
ledger thunder pocket nine
Combine two rules for more spread. Any single rule above is a decent start, but combining two (say, letter-count-append and first-letter word substitution) produces enough per-site variation that even someone who saw two or three of your actual passphrases would have a hard time reconstructing the underlying rule — there are simply too many possible rules that would fit two or three data points.
What makes a rule good
Fast to compute in your head. If it takes you two minutes and a scratchpad every time you log in, you won't stick with it — and a scratchpad defeats the purpose.
Not derivable from the output alone. A rule like "always add the word 'dog'" is trivial to spot from a single leaked password. A rule that depends on counting letters or mapping to a private word list isn't obvious just by looking at the result.
Never written down or spoken aloud, anywhere, ever. Not in a note app, not in a text to a family member, not as a code comment. The whole scheme's security rests on the transformation staying entirely private. The moment the rule exists outside your head, it can be found.
Consistent, so you can always reproduce it. If the rule is so clever you can't reliably recompute the same passphrase for a site you haven't visited in six months, it's failed at its actual job.
The honest caveat
This kind of personal algorithm is a real improvement over reusing one passphrase everywhere, and it's a reasonable approach for the dozens of low-stakes accounts most people have. But it's worth being clear-eyed about its limits compared to a password manager generating truly random, unique passphrases per site:
If an attacker ever obtains several of your real passphrases (say, from two or three breached sites), a sufficiently motivated person can sometimes spot the pattern, especially if your rule is simple.
You still have to actually keep the rule secret for the rest of your life — no exceptions, including to people you trust.
It doesn't protect you from phishing, keyloggers, or a compromised device the way multi-factor authentication does — a mental algorithm is only ever one layer of a larger defense.
For your highest-value accounts — primary email, banking, anything tied to account recovery for everything else — a password manager with fully random per-site passphrases and multi-factor authentication turned on is still the stronger choice. A mental algorithm is a solid middle ground for the accounts where you're weighing convenience against remembering yet another manager entry, not a full replacement for one.
Password Generator