I tried going to a similar algorithm of my own invention some years ago, and ran into this exact problem. Mostly sites that don't allow certain characters (which is asinine). Now I have a few different algorithms that I use that are friendly to common password requirements, and I keep a list of which algorithm I used on each website, rather than just a list of the passwords. Since the algorithms only exist in my head, I think it's secure enough for most purposes.

You are not alone in this strategy. I just wish we could have a password standard.

There are ways around it: using the code for the key directly north-west of the problematic character, and if that's a bad character go further, maybe wrap around, or try to follow through the problem character (a/& -> &/| -> |/f, thus f would be the code for a) etc.

As for remembering which sites have what restrictions, I can keep that stuff in my head (looking at you Microsoft), but I guess you may have more accounts than me. Then again, when a password fails, then all you'd have to do is retry with a safer version (and maybe only have two password kinds, for convenience - full-blown char support, and minimalistic lowercase-letters only, so you'd only have to retry a single time after the first failed login).

Personally, my biggest problem with this card is that it doesn't provide enough value.

> Then again, when a password fails, then all you'd have to do is retry with a safer version

And after three or five failed login attempts you get locked out and have to call the bank for a password reset, and throw away the damn card in frustration.

> (and maybe only have two password kinds, for convenience - full-blown char support, and minimalistic lowercase-letters only, so you'd only have to retry a single time after the first failed login).

If you're authenticating with more than HN and Reddit, you'll encounter much more than two mutually exclusive password policies.

Nah man, don't sweat it this case is thoroughly covered in their faq: you can petition those firms by tweeting them with #strongpasswords hashtag and @qwertycards.

Yeah, qwerty card are badly thought out, they know of the shortcomings and they don't care much as they're in this business for the money.