I have used this mechanism manually with a simple algorithm and a secret key + site name for a while... And all of the things you mention are exactly on point :

I have used this mechanism manually with a simple algorithm and a secret key + site name for a while... And all of the things you mention are exactly on point :) My solution has been to have 3 different techniques: - a very sofisticated master password + algorithm for very critical things - a secondary, less sofisticated for less important things - a dummy password that i use for silly stuff I keep an up to date list of applications of the second tier. The first tier is easy enough to remember since it's the critical apps. I also go with 2fa when I can.