A possible mitigation of the obvious problem (the pattern itself) is instead to use a hash function on some aspect of what you&#x27;re trying to log in to: a hash of the main domain, the human name, whatever. That way if a password is compromised, it may look like a common pattern is being used, but the &quot;random&quot; part of one site&#x27;s password won&#x27;t do any good on another site.<p>The challenge being to implement a hash app everywhere you might be that will generate the correct hash. Maybe a very simple mental hash function would be enough; mass attacks would probably be foiled, and individual attackers may be too lazy to bother figuring out the hash.<p>There remains the problem of changing the password due to some necessity, like policy or compromise.<p>EDIT: If this was app-based, then each time you change a password, the app would record that fact, and incorporate it into the hashing data, so that a different hash is generated. The problem then being synchronizing that fact among all your installations of the app. And if you were using a mental hash, I don&#x27;t know how you&#x27;d remember this across all your logins; possibly some central piece of data that you could easily look up, to see that you&#x27;ve changed your password one or two or N times, that is easy to incorporate into the mental hash.