Isn't using the same basic string with only a few tweaks to it here and there easy to crack (especially if the delta is information related to the site it's for

Isn't using the same basic string with only a few tweaks to it here and there easy to crack (especially if the delta is information related to the site it's for)? And doesn't it represent its own sort of "single point of failure"?