I'm personally not a fan of 1, and I don't know that it can ever work to complete satisfaction. Two reasons: 1) domain names change sometimes. especially wit

I'm personally not a fan of 1, and I don't know that it can ever work to complete satisfaction. Two reasons: 1) domain names change sometimes. especially with the current trend of weird ending domains, and "www.getx.com" which later becomes 'x.com' when they finally pay the squatters. Or a rebranding, or subdomains, etc. How do you handle changes, without recording them? Proactively you can change your password when such a thing occurs, but that's not a reliable assumption. 2) versioning. If you have to change a password every X time periods, how do you track which version you're on? without a database? you could salt it with the time the last password was created, but what about time zones? different calendar systems (did I set that password in china, or jerusalem, or canada...?)? All of which leaves you with a database of some kind in some (fairly likely to occur) situations, which means you essentially have a password manager. As you point out, a 90% solution simply isn't good enough.