> What about password strength requirements, length restrictions, etc.? I have a JSON file that describes if a particular domain has certain restrictions, e.g.

> What about password strength requirements, length restrictions, etc.? I have a JSON file that describes if a particular domain has certain restrictions, e.g. max length, ensure at least 1 symbol, ensure at least 1 uppercase, ensure at least 1 lowercase, etc. and then deterministically edit the password to match any such requirements. Another way to do appease the idiotic upper/lower/symbol rules is to just append something like "Aa$1" to every password, though it reduces entropy for sites that have a max length. These requirements are public information, and you could store this JSON file on a public github repo if you wanted. I also store in this JSON file another piece of information, which is the Nth password on the site. The I run something like 500000+N irritations of PBKDF2 where N is the nth password I use on the site. The value of N for sites not in the JSON file is 0. If I need a 2nd password on a site due to it requiring me to change the password, I increment N and store in the JSON file. For this reason I store the JSON file in a private github repo. I know it's not the best practice but meh the value of N is not that sensitive compared to the master password, which is stored nowhere and has never been entered into a machine I do not own and trust.