You think it's pretty solid - but it may not be. Computers are fast these days - passwords even loosely based on real words and common substitutions can be brute-forced - so not saying your system is bad (it's probably what most of us do, more or less) - but this passwordcard idea seems equally valid - you are still free to use it however you want, and without physically obtaining it, someone would have no idea where to start. If they did physically obtain it - they'd still have to know how you used it (which is up to you) - and that's assuming you didn't add some other out of band information (which you are free to do).