"Just use a password manager" is actually a simplification for doing proper threat modelling because most people don't bother thinking about it. For each site

"Just use a password manager" is actually a simplification for doing proper threat modelling because most people don't bother thinking about it. For each site you have to consider; what is the worst thing that could happen if somebody gain access to that account? Do you have a meaningful online presence on the website? Did you enter private information that you don't want to go out? Did you provide your credit card to the site? It would actually be useful if sites where classified by the type of information and access that they require. Another short answer would be: memorize your computer, email and password-manager passwords. Use the password manager for day-to-day sites. Add a second factor for juicy targets like net banking. For all the other sites, generate a random string and throw it away. Use password reset the next time you want to log into it.