The most important thing I realized when it comes to passwords was the classification into 2 types: strong passwords (keys, local login, local encryption, master passwords for password managers) which is best generated using the Xkcd method, and then the less obvious disposable passwords (all non-local usage, i.e. websites and other temporary need). For the later, I use SuperGenPass[1]. It ensures that 1) my passwords are not reused across sites and 2) they are strong without the need to remember them directly. Because SGP uses hashes, it is very easy to add counters to existing passwords/secret phrases and create a brand new password without much mental effort. I've outlined such a procedure in the issues[2]. Using counters in the "secret" field, I will probably never ever need to change my master passphrase.

I won't deny though that for mobile use, it's a bit cumbersome. The Android app is fine and free[3], and iOS app is a buck[4]. And overall it's a pain if you must login to sites frequently (ideally, using a native app reduces this greatly, login once until you manually logout).

It's also pretty confusing for non-technical people to get behind. I actually sent out an entire email blast to friends and family giving them my best attempt at an explanation, argument, and tutorial of how to use it. I don't think anyone did it.

So while the interface is kind of clumsy, the strategy is solid and I love knowing that I can use it.

[1]: http://www.supergenpass.com

[2]: https://github.com/chriszarate/supergenpass/issues/40#issuec...

[3]: https://play.google.com/store/apps/details?id=info.staticfre...

[4]: https://itunes.apple.com/us/app/supergenpass/id451606360?mt=...