My threat model accounts for leaked passwords, even if you are able to identify the system I use, you would have to iterate through ~8! possiblities minimum per

My threat model accounts for leaked passwords, even if you are able to identify the system I use, you would have to iterate through ~8! possiblities minimum per account. There's no underlying patterns that allow for shortcuts. There's nothing wrong with a system as long as you can't guess the system by comparing multiple leaked passwords. I don't see how it could weaken security significantly if your system includes randomness in some sense. For example, the order in which you might place words and special characters or the letter placements which you substitute. It's absolutely possible to have a system without weakning security. But that might fundamentally have the same considerations that rolling your own crypto solution would. I was thinking about those very same mistakes when making my system. I expected that a technical crowd like HN would care about stricter privacy, but I continue to be surprised. The threat model I assume is the reason why I would never use passkeys. From the responses I have gotten, my threat model seems stricter than average. Using a manager generated password feels like security through obscurity. As does using a single point of failure piece of hardware where I can't backup the secret. I don't want to use a "virtual" passkey that is attached to a MS or Google or Apple login, especially for replacing passwords. A secret I don't control isn't my secret, similar to the idea of not your keys not your wallet when dealing with cryptocurrency. In this case, there's a very real price of privacy to pay for convenience.