How about using 15+ character passphrase and creating an upper / lowercase seeded permutation of the passphrase. Eg

My_Pa$$phrase

becomes

ahpr_a$$()eysM

An attacker, doesn't know your character set, or it's length, so he's left facing an unknown quantity.

Even if he gets hold of one of your scrambled passphrases, is he going to realise what you're doing. How does he know it's not just a high entropy random string.

I produced an Android app using this method here...

play.google.com/store/apps/details?id=appinventor.ai_adrianpeirson60.Pwd_Creator

The description says :

Here are 4 Passwords: notice anything about them ?

K6_0C1I(Y)€m9
€MK(IYC0)_691
k_01y(ci€m9)6
C€69M1IK0)(_Y

They're all upper and lowercase rearrangements of

Mick€y_1960

There are around 6 Billion Password permutations you can make from

Mick€y_1960

If you lost your password, 6 Billion is small enough, that you could brute force it. You might need professional help, but it's doable.

This might be ok for medium security, I don't know if I'd feel comfortable if the US Nuclear codes were encrypted using this method, though all things being equal, if an attacker DOESN'T get hold of your password then it's probably safe.

If your scrambled password were 25+ characters long, even if he got hold of one of them, and thus now knows your character set, he still has to brute force your other ones.

You on the other hand can Hash straight to them using your seed value(s).

How about using 15+ character passphrase and creating an upper / lowercase seeded permutation of the passphrase. Eg

My_Pa$$phrase

becomes

ahpr_a$$()eysM

An attacker, doesn't know your character set, or it's length, so he's left facing an unknown quantity.

Even if he gets hold of one of your scrambled passphrases, is he going to realise what you're doing. How does he know it's not just a high entropy random string.

I produced an Android app using this method here...

play.google.com/store/apps/details?id=appinventor.ai_adrianpeirson60.Pwd_Creator

The description says :

Here are 4 Passwords: notice anything about them ?

K6_0C1I(Y)€m9

€MK(IYC0)_691
k_01y(ci€m9)6
C€69M1IK0)(_Y

They're all upper and lowercase rearrangements of

Mick€y_1960

There are around 6 Billion Password permutations you can make from

Mick€y_1960

If you lost your password, 6 Billion is small enough, that you could brute force it. You might need professional help, but it's doable.

This might be ok for medium security, I don't know if I'd feel comfortable if the US Nuclear codes were encrypted using this method, though all things being equal, if an attacker DOESN'T get hold of your password then it's probably safe.

If your scrambled password were 25+ characters long, even if he got hold of one of them, and thus now knows your character set, he still has to brute force your other ones.

You on the other hand can Hash straight to them using your seed value(s).

How about using 15+ character passphrase and creating an upper / lowercase seeded permutation of the passphrase. Eg (My_Pa$$phrase) becomes

ahpr_a$$()eysM

An attacker, doesn't know your character set, or it's length, so he's left facing an unknown quantity.

Even if he gets hold of one of your scrambled passphrases, is he going to realise what you're doing. How does he know it's not just a high entropy random string.

I produced an Android app using this method here...

https://play.google.com/store/apps/details?id=appinventor.ai_adrianpeirson60.Pwd_Creator

The description says :-

Here are 4 Passwords: notice anything about them ?

K6_0C1I(Y)€m9

€MK(IYC0)_691

k_01y(ci€m9)6

C€69M1IK0)(_Y

They're all upper and lowercase rearrangements of (Mick€y_1960)

There are around 6 Billion Password permutations you can make from (Mick€y_1960)

If you lost your password, 6 Billion is small enough, that you could brute force it. You might need professional help, but it's doable.

This might be ok for medium security, I don't know if I'd feel comfortable if the US Nuclear codes were encrypted using this method, though all things being equal, if an attacker DOESN'T get hold of your password then it's probably safe. If your scrambled password were 25+ characters long, even if he got hold of one of them, and thus now knows your character set, he still has to brute force your other ones. You on the other hand can Hash straight to them using your seed value(s).

How about using 15+ character passphrase and creating an upper / lowercase seeded permutation of the passphrase. Eg

My_Pa$$phrase

becomes

ahpr_a$$()eysM

An attacker, doesn't know your character set, or it's length, so he's left facing an unknown quantity.

Even if he gets hold of one of your scrambled passphrases, is he going to realise what you're doing. How does he know it's not just a high entropy random string.

I produced an Android app using this method here...

play.google.com/store/apps/details?id=appinventor.ai_adrianpeirson60.Pwd_Creator

The description says :

Here are 4 Passwords: notice anything about them ?

K6_0C1I(Y)€m9
€MK(IYC0)_691
k_01y(ci€m9)6
C€69M1IK0)(_Y

They're all upper and lowercase rearrangements of

Mick€y_1960

There are around 6 Billion Password permutations you can make from

Mick€y_1960

If you lost your password, 6 Billion is small enough, that you could brute force it. You might need professional help, but it's doable.

This might be ok for medium security, I don't know if I'd feel comfortable if the US Nuclear codes were encrypted using this method, though all things being equal, if an attacker DOESN'T get hold of your password then it's probably safe.

If your scrambled password were 25+ characters long, even if he got hold of one of them, and thus now knows your character set, he still has to brute force your other ones.

You on the other hand can Hash straight to them using your seed value(s).