Is this mentally computable password system, cryptographically secure? And anything like this out there I can find? Please bear with me on this, I'm not learnt in this field, just trying to ask questions about the security of my encryption method.
I'm trying to create a mentally computable human password manager method that can generate strong passwords using a set of operations and a master password, so that you only have to really remember one password to have strong passwords for all your accounts. And also to never have to change the system in your life so you can have backwards compatibility. The system will work even when everything has been exposed to a public. My desire is to have the system be intuitive and user friendly (instead of having to put effort into memorizing 1pad charts, etc.) yet secure.
I had some feedback elsewhere that my system outputs strong passwords against normal attacks but is vulnerable to a determined adversary, so now I made some changes.
For the sake of simplicity, I will be using weak passwords, but bear in mind it doesn't take that much to obfuscate the final output with scrambling, numbers and symbols.
So, I have a string of 34 letters, each letter representing a word that starts with said letter. That is my master password.
Let's begin with making a Google account:
1. Google
First, I take the word Google to apply the seed
G = 7th letter of the alphabet (position)
Google = 6 letters (length)
2. GoogleLydngr
Then, I add the 6 (length) letters after the 7th (position) letter of the master password
3. GoogleLydAroundngr
At this point, the last letter &quot;r&quot;, represents a word which has 3 letters
I move back 3 spaces and add the word &quot;Around&quot;, which is the next letter/word after the &quot;r&quot;
GoogleLydAroundngr
So that will be my password for Google. This example is easily bruteforced but my question isn't about the password strength but more of the concept.
Now I create a Facebook account, using the same system:
FacebookGlAndydngra (6 position, 8 length)
You will notice the difference is the letters and number of letters, and that I moved back 6 spaces instead of 3, and has added &quot;And&quot; instead of &quot;Around&quot;.
I create 3 more for Instagram, Twitter and Microsoft:
InstagramDngrNeveraadyn (9 position, 9 length)
TwitterNgraNeverady (20 position = 0 = 10 position, 7 length)
MicrosoftYungRunlydng (13 position = 3, 9 length)
So, you hacked my accounts through a keylogger, and got a hold of all my passwords. Also, you discover my order of operations. And finally, I wrote down my master password in a text file, so you know that too. I lose everything.
But I go ahead and create new accounts using the same system. However, I change the master password.
How easy is it to crack my new accounts just based on the fact you know everything now... except for my new master password?
For anyone who's curious, the master password is Nggyunglydngraadyngmycngsgngtalahy

Never gonna give you up
Never gonna let you down
Never gonna run around and desert you
Never gonna make you cry
Never gonna say goodbye
Never gonna tell a lie and hurt you

But seriously, this is a serious question. I'm trying to use the chaos of language and musical timing to generate more variety in place of complex calculations. But I'm not smart or educated in this field to know how flawed my system is.
And just another tidbit, one song alone can generate several passwords for when I need to change a single password exclusively, all I have to do is use a different verse of the song or use syllables instead, or something.
Thanks and appreciate any help or comment given.
Firstly, you shouldn't really invent your own password manager, except for fun/experimentation/learning purposes.  Especially if you are a beginner.
Regarding your comments, I don't really see how managing your own in your head can be less hassle than managing a standard one on a machine.  I use google/chrome's (BOO!) so can use across devices and could give away passwords to certain accounts, for whatever reason.
You may find this interesting reading.  It seems very similar to your idea.  It uses a pin as well as a cue for each site.  It also goes into detail about the reduction in security as you use the system to &quot;generate&quot; more passwords.
Your scheme gives away bits of the master key in each password, and has virtually no real entropy.  There is a 23.5% chance the letters in your passwords will be 'g'.
If we change the lyrics to something tasteful like the opening verse of Dylan's Subterranean homesick blues, we still have 0% chance of a 'z'.
There are 256 possible values in a random byte.
Imagine another scheme I invent which uses a cryptographically secure salted hash, where the salt is the website address/master key/time added to database, and the input to the hash is the master key. My master key is &quot;never gonna give you&quot;.

Each of my website passwords might be anything.  They are not all based on the letters in my master key.
If websiteX password is breached, it gives an attacker nothing about the password for websiteY, or the master key.
When I change my password for websiteX, I don't need to change my master key.
The basic security of my system relies on a cryptographically secure hash that wasn't designed by me.

Obviously (as mentioned) I wouldn't use my own scheme because there are already better existing schemes designed (and implemented) by people who know better.