First of all, choosing nursery rhymes or movie titles isn't much better than choosing dictionary words. That strategy has been shown to have low entropy. Multiw

First of all, choosing nursery rhymes or movie titles isn't much better than choosing dictionary words. That strategy has been shown to have low entropy. Multiword passwords are easier to remember, but you need something actually random. If you want a strong multiword password, it's a good idea to have an actual RNG do it for you, so you can use something like http://passphra.se/ http://passphra.se/. If they don't already, hackers will soon have dictionaries that will crack passwords like "ring around the rosy" and "there is no spoon" as easily as "champagne", but they're never going to crack a password like "eager man dirt fly" in better than brute force time. OK, so with that out of the way, let's say you've chosen a weak (and common) password. If people start using this self-salting scheme, it's a fair bet someone else that will use the same self-salt as you, and that means two identical hashes in the database. That's bad news. But it's also easy to fix. Simply choose some fixed salt to also add to your password. It could be the first two letters of your username, for example. That way, if "bobmarley" and "jackblack" both have the password "champagne" and both used the first four letters of the website for their salt, then on linked in one will be "linkbochampagne" and the other will be "linkjachampagne", and they can rest knowing that it's very unlikely that their password will hash the same as someone else's.