I am working towards a two-tiered system. First tier is kept on a physical PasswordCard and muscle memory, and cycled annually. This is for the sensitive passwo

I am working towards a two-tiered system. First tier is kept on a physical PasswordCard and muscle memory, and cycled annually. This is for the sensitive passwords. Second tier is handled entirely with a password manager. The password manager generates, stores, and fills them in for me. These are not sensitive and cycled/recycled as needed. I still have this nebulous "third tier" of leftover passwords that haven't migrated on the new system, where I basically use variations of the same two semi-secure passwords. I hope to eventually get rid of this tier.