> using a mental algorithm that generates a unique password per site. If someone has access to one or more of your passwords and can reverse engineer your 'alg

> using a mental algorithm that generates a unique password per site. If someone has access to one or more of your passwords and can reverse engineer your 'algorithm' then you have effectively just reused the same password everywhere. Even if you include some amount of memorized numbers or whatever the entropy is probably a lot lower than having an xkcd-strong password in a manager and randomized passwords stored in it.