My view is your secrets should be secure even if the attacker knows everything about how they are generated and used. For example: My password is 8192 characters long, leveraging only the ASCII character set (except \n\r\t\0) It is changed every 28days at 11:05am It is only used on exactly 1 website and the username on that website is also only used on that website and randomly generated as well.

Good luck (Tell me how and where I can make this stronger)

> Tell me how and where I can make this stronger

Make it 8193 characters long, change it every 27 days at 11:04am, but most importantly: use it on exactly 0 websites.

Good luck

With your username, I actually believe you...

Telling someone your password is 8 characters long and memorable vs telling them it is 8192 characters long and unrecallable are two entirely different things.

This is a very hilarious post. Bravo, sir, or brava, madam. (Revealing your gender would likely be a security risk - if you leave that unspecified it doubles the space of possibilities!) I don't know what joyless types would downvote you.