Hashing a password before using for online accounts I don't actually know what I'm talking about, so apologies if I get anything wrong. At the moment I have a password naming system for most of my online accounts that looks something like this: masterpassword + appname, where appname is the name of whatever service the password is for. ex. $sickpass123$_SoundCloud and $sickpass123$_Gmail. The idea is to have an easy to remember master password combined with the app name so every password is unique. I am worried though, because if a proactive individual manages to figure out one of my passwords, it would be easy for them to figure out the other passwords since they all contain the same master password.

I thought of running each password through a hash function (every time need to enter it) as this would ensure that each password is unique. ex. 8d9f24e142b33c2f7f3d59fc7c6043a7 and 84e08387ef918182154713d388f5ea62. In addition, I could encode the hash output in base64 or ascii85 to fulfill the capital letter/number/symbol requirements for passwords in online services. ex. OGQ5ZjI0ZTE0MmIzM2MyZjdmM2Q1OWZjN2M2MDQzYTc= and ODRlMDgzODdlZjkxODE4MjE1NDcxM2QzODhmNWVhNjI=.

I am also aware of password generators, but they generate a random string each time rather than a predictable output. I would rather have the same output be generated every time I enter my password. That way, it will be easy to remember every password, but the hash function will make each one virtually unique. Also, if only the hash output is given to websites, rather than the original password, the sites themselves will not know my pattern.


Is there any problems from using the approach I am suggesting?
Would it actually be less secure if the server encrypted my already encrypted password?
Should I encode the output in base64 or ascii85, or something similar?
Which algorithm would be best suited to this task? Do I need something more secure like SHA-1 or will the more primal MD5 be adequate (would anyone care enough to try to break the hash)?


EDIT: Thanks for all the answers. They were all very informative. I think I might try a password manager, perhaps MasterPasswordApp as @Matty suggested, as it'll be easier to manage.
Is there any problems from using the approach I am suggesting?


Yes, there are several.

First of all, some sites generate first time passwords, or even long time passwords. You may want to store those too. What if a site requires frequent updates?

If one password is reversed, you'd still loose confidentiality.


  Would it actually be less secure if the server encrypted my already encrypted password?


No, usually not. If you don't know the server's key then using encrypted input will not change encryption. Same goes for password hashing basically. If you don't operate with the same parameters (e.g. salt), then you are unlikely to be vulnerable.


  Should I encode the output in base64 or ascii85, or something similar?


Anything the target site accepts. This points to another issue since the sites may require passwords in a specific format. Both the alphabet (character input) of the password and the size may be restricted. So some sites would be better off with base64, some with base 85 and others with neither of the above. E.g. an 8 character base 64 string only has 48 bits of security, allowing brute force attacks. How are you going to remember which format is best for specific sites?


  Which algorithm would be best suited to this task? Do I need something more secure like SHA-1 or will the more primal MD5 be adequate (would anyone care enough to try to break the hash)?


When constructing security protocols you'd have to assume that somebody "cares". Otherwise you might as well skip the whole thing. That said: no, SHA-1 or MD-5 will likely not influence the choice much.



That all said and despite all the indicated issues, hashing the password is still somewhat more secure than providing a password with extension directly. But since you would need to have a device &amp; application for this anyway, I'd recommend using a password manager instead (that e.g. applies a password hash or PBKDF over the master password to decrypt the database).