I got into a conversation today with some web developers, talking about recent articles about a major password breach.

This got me to thinking—with some prompting from shadowy web standards advocate and staunch info-sharing supporter Tantek Çelik—that this would be useful to document.

Unique email addresses and passwords for every website

The basic idea is this: every single website signup gets a unique email address and unique password. This way, if a website is breached and the passwords are leaked, no other accounts are compromised, just that website's.

The trick is to do it in a way that I can remember, or easily derive the usernames and passwords per site, so I don't have to rely on a pain-in-the-posterior password manager, and can log in from anywhere easily.

Obviously I'm not going to give away details of how I specifically do things, but I can…