That is the crux of my concern. If a cracker were using an automated method of trying passwords that had been compromised, I would expect that they might simpl

That is the crux of my concern. If a cracker were using an automated method of trying passwords that had been compromised, I would expect that they might simply get a failed attempt and move on. In a file of, say, a couple hundred thousand accounts, would they bother having an automatic retry with different characters? If it were someone getting the password and trying it manually, however, I could definitely see them figuring out that all they needed to do would be to change the first or last character, particularly if it were an obvious one, such as the first letter of the website or something. Clearly, I need to have a way to alternate multiple characters in a method that I can reliably remember.