That doesn't change the GP's point. One compromise means that password and spacebar code is compromised for all passwords. Other comments have already addressed

That doesn't change the GP's point. One compromise means that password and spacebar code is compromised for all passwords. Other comments have already addressed how wimpy a substitution cipher is. Add to that that you can't reasonably cycle keys here, and you have yourself one pretty terrible password system.