That's why the rule needs to be non-obvious. The rule must be a secret in itself and there is no way that a hacker would figure out the rule from just a single

That's why the rule needs to be non-obvious. The rule must be a secret in itself and there is no way that a hacker would figure out the rule from just a single or a couple of passwords. For example, if I give you a sequence of 2 points, there are an infinite number of functions which could pass through these two points. A hacker who knows 2 numbers would not be able to figure out the other points unless they know the function. Actually it's weird (to the point of being suspicious) why none of the password managers I know of use this principle for generating passwords from a single master password; then they wouldn't even need to store any of peoples' passwords at all. You wouldn't need password manager companies since it could be implemented as a purely front-end component (e.g. a standalone Chrome extension which doesn't connect to any server). The user would only have to remember a single master password. You can basically do this using hmac-sha256 hashes to produce an infinite number of new hashes from a single secret seed and it's impossible to figure out hashes based on their sibling hashes and also impossible to figure out the secret seed (preimage) from any hash.