Yes, it has to be exactly the same original photo, because (1) most likely it contains more entropy (2) the original is the single source of truth, (3) you can

Yes, it has to be exactly the same original photo, because (1) most likely it contains more entropy (2) the original is the single source of truth, (3) you can still use the photo anywhere as long as it’s not the original. Generated password is essentially password’=hash(hash(photo)|domain|password) Usually, you don’t have to rotate strong passwords. If you really want, that’s what I do: I just add a postfix to the password I remember. For example, I can use ziTJune1, ziTJune2, etc. They generate completely different passwords.