Home / Journal

Encrypt Your Own Passwords — In Your Head

Acronix Jun 09, 2026 Security
Encrypt Your Own Passwords — In Your Head

In my last post on choosing strong passwords, I said the single most important habit is a unique password for every site — and that most people solve that with a password manager. Managers are excellent, and I recommend them. But some people don't want to depend on an app, a vault file, or a cloud sync that could be lost or breached. So let me show you the alternative I promised: how to generate your passwords in your head.

The trick is to stop remembering passwords and start computing them. You memorize two things — one secret phrase and one small algorithm — and from those you can derive a different strong password for any website, on the spot, with nothing written down. The site's name is the only input that changes, so every site gets its own password. Nothing is stored, so there's nothing to steal.

This isn't a brand-new idea — it's a known category called stateless (or deterministic) password generation. Tools like Spectre (formerly "Master Password") by Maarten Billemont, LessPass, and Stanford's PwdHash all do the same thing with real cryptographic hashing. What we're building is the human-computable version of that idea — no software, no install, simple enough to run in your head, but strong enough to matter.

The three ingredients

Every mental password formula has three parts:

  1. A secret core — a chunk that's the same every time. This carries most of your strength, so it should come from something long that only you know.
  2. A site transform — a rule that turns the website's name into a short string. This is what makes each password different.
  3. An assembly rule — a fixed way you glue the pieces together.

Memorize those three, and you never memorize a password again. Let me build an example. Important: invent your own phrase and your own rules — never use the example below, because the moment it's published it's worthless.

Step 1 — Your secret core

Take a sentence only you would think of, and compress it to a mnemonic. Say your sentence is:

"I bought my first guitar back in 2009!"

Take the first letter of each word, keep the number and the punctuation:

I bought my first guitar back in 2009!
↓
Ibmfgbi2009!

That's your secret core — Ibmfgbi2009!. It's twelve characters with upper, lower, digits, and a symbol, but you don't memorize it — you memorize the sentence, which is far easier and never written down.

Step 2 — Your site transform

Now a rule to turn a site's name into a few characters. Here's one simple, head-friendly rule:

  • Take the first three letters of the site's domain.
  • Capitalize the first of them.
  • Add the number of letters in the domain name as a digit on the end.

Run it on a few sites:

github     →  Git  + 6  →  Git6
facebook   →  Fac  + 8  →  Fac8
amazon     →  Ama  + 6  →  Ama6

Pick rules you can do without paper. Counting letters, taking first/last letters, alternating case — all fine. Avoid anything that needs a Caesar shift or math in your head; you want this to take two seconds.

Step 3 — Assemble, then cap it off

Decide one fixed pattern and always use it. Mine is site transform, then secret core, then a two-part tail — the tail folds in a little more site-specific detail so no two passwords ever rhyme:

  1. Start with the site transform, then the secret core.
  2. Add the website's 2nd letter, capitalized, to the very end.
  3. Finish with one last number: the site's letter-count × 2.

Run it end to end:

github    →  Git6Ibmfgbi2009!  + I (2nd letter)  + 12 (6×2)  →  Git6Ibmfgbi2009!I12
facebook  →  Fac8Ibmfgbi2009!  + A (2nd letter)  + 16 (8×2)  →  Fac8Ibmfgbi2009!A16
amazon    →  Ama6Ibmfgbi2009!  + M (2nd letter)  + 12 (6×2)  →  Ama6Ibmfgbi2009!M12

And that's the whole system. Every password is 18+ characters, mixes all four character types, and is unique per site — yet you're not remembering any of them. You're remembering one sentence and a short list of rules, and computing the rest each time you log in.

Handling the real world

Two wrinkles you'll hit, and how to fold them into your algorithm up front:

  • Sites with annoying rules. Some demand a symbol, some cap the length, some ban symbols entirely. Decide a fallback now, e.g. "if symbols aren't allowed, drop the !" or "if it's capped at 12, use only the first 12 characters." Bake the exception into your algorithm so it's still deterministic.
  • Forced password changes. If a site makes you reset, your formula gives the same answer — so add a tiny version you can bump at the very end: append a, then b, and so on. Git6Ibmfgbi2009!I12 becomes Git6Ibmfgbi2009!I12b. You only have to remember which sites you've bumped, not the passwords — and yes, that little bit of tracking is the scheme's least elegant part.

Is this actually safe? (the honest part)

Let me be straight with you, because this is a security blog and not a magic-trick blog.

Where it's strong: it kills password reuse, which is the number-one way accounts get popped through credential stuffing. Every site gets a different, long password, and there's no vault file or cloud account to breach. For most people, that's a massive upgrade over Summer2025! everywhere.

Where it's weak: the catch is that all your passwords share the same secret core. If just one of your derived passwords leaks in a breach — and an attacker realizes it's formula-generated — a determined, targeted attacker who collects a couple of your leaked passwords could try to reverse-engineer the pattern and predict the rest. That's a real, if advanced, risk. You mitigate it by:

  • Making the secret core long and genuinely unguessable (it's doing most of the work).
  • Keeping the site transform non-obvious — don't make it trivially "first three letters."
  • Pairing this with multi-factor authentication everywhere, so a guessed password alone isn't enough.

The honest bottom line: a password manager filling in fully random, unrelated passwords is still the gold standard, because random passwords share no pattern to reverse. This mental method is a strong, no-dependency middle ground — far better than reuse, not quite as bulletproof as random. Know that trade-off and choose with your eyes open.

Try it

Spend ten minutes building your own: pick a sentence nobody would guess, write down (then destroy) your rules, and practice deriving a few sites until it's automatic. After a week it becomes muscle memory, and you'll never type a reused password again.

It isn't as bulletproof as a manager spitting out fully random strings — but it's yours, it needs nothing but your brain, and it ends the password reuse we warned about in Choosing Strong Passwords. Build your own cipher, keep the recipe to yourself, and switch on MFA while you're at it.

If you found this useful, subscribe to our RSS Feed and YouTube Channel. More security writeups are on the way.

← All articles