I realize it's generally considered bad idea to use the same password everywhere.

I can use icloud / lastpass to generate my passwords for me, but that leaves me clueless when I don't have access to these services, or attacks to those services.

Does it make sense to use 1 "master password", but modified for each website / service with set of rules?

For example, let's make my master password foobarone and name of the service is "facebook". My rule is to shift 1st letter X. Where X is number of first letter in service name (facebook, first letter is f, f = 6). Therefore, I am shifting 1st letter by 6, so my final password for facebook is loobarone. In reality, these rules would be more complicated.

Does this provide me layer of security, or is my thinking out of line and the only solution is to have random password for every service?

• Cross-site duplicate: Is it a good idea to have a “master” password? – Artjom B. Jan 29 '16 at 22:44
• Although this is on topic here, I don't think we should encourage dupes. I think the question should be closed unless it is made specific to a cryptographic algorithm to perform the derivation. – Maarten Bodewes Jan 30 '16 at 11:23
• See passassin.com which works in a similar manner, but uses an HMAC to generate the passwords. – fadedbee Jun 13 '19 at 11:12

HMAC_MD5("foobarone", "facebook.com") = "b5bda098afd19b1f7992abfa9ab7d710"