I don't actually know what I'm talking about, so apologies if I get anything wrong. At the moment I have a password naming system for most of my online accounts that looks something like this: masterpassword + appname, where appname is the name of whatever service the password is for. ex.
$sickpass123$_Gmail. The idea is to have an easy to remember master password combined with the app name so every password is unique. I am worried though, because if a proactive individual manages to figure out one of my passwords, it would be easy for them to figure out the other passwords since they all contain the same master password.
I thought of running each password through a hash function (every time need to enter it) as this would ensure that each password is unique. ex.
84e08387ef918182154713d388f5ea62. In addition, I could encode the hash output in base64 or ascii85 to fulfill the capital letter/number/symbol requirements for passwords in online services. ex.
I am also aware of password generators, but they generate a random string each time rather than a predictable output. I would rather have the same output be generated every time I enter my password. That way, it will be easy to remember every password, but the hash function will make each one virtually unique. Also, if only the hash output is given to websites, rather than the original password, the sites themselves will not know my pattern.
- Is there any problems from using the approach I am suggesting? Would it actually be less secure if the server encrypted my already encrypted password?
- Should I encode the output in base64 or ascii85, or something similar?
- Which algorithm would be best suited to this task? Do I need something more secure like SHA-1 or will the more primal MD5 be adequate (would anyone care enough to try to break the hash)?
EDIT: Thanks for all the answers. They were all very informative. I think I might try a password manager, perhaps MasterPasswordApp as @Matty suggested, as it'll be easier to manage.