Problem is, that not all sites use the same style of passwort.
Some need Lower-/Uppercase, some with numbers, some with special Chars, some restrict to minimum of x chars, some use a maximum.
Your system works not for all things, i use a similar system, but store a bunch of passwords with last pass. Only really important passwords are in my head.
> Only really important passwords are in my head.
That has not worked well for me. I have lost a small amount of bitcoin, and some encrypted homedirs and encrypted hard drives.
Yes, occasionally sites don't allow it, but I've found if you use at least one of: uppercase, lowercase, numbers and symbols, and have a length of around 10, then it will go through virtually all sites.
I keep meaning to collate idiotic password rules so you can see for sure which patterns work in all of them, but I've never got around to it.
I use a method like that, but the result of that step then goes through PwdHash (whose code is small enough to inspect for naughtiness) so that multiple web sites wouldn't expose the scheme.
> it would take several compromises (and a weirdly dedicated attacker) to work out my algorithm.
Use that algorithm widely enough and several compromises are guaranteed. The only thing protecting your password is that url manipulation.
I do a vaguely similar thing but I don't share it with the world :)
It works pretty well. Different password for each site, I only have to remember a few things, and it would take several compromises (and a weirdly dedicated attacker) to work out my algorithm.
For example, my 'insecure' fixed part might be 'Tenk5$' (I recommend including uppercase, lowercase, a number and a symbol in that part to get around idiotic password requirements). Then my algorithm could be 'the last 5 letters backwards, skip the first vowel'. In which case my password for HN would be 'Tenk5$rtani'.