Well, I start with the observation that protecting my passwords against exhaustive attacks is unnecessary. At most sites, only a very limited number of tries are permitted before the account is locked. Further, the vast majority of successful attacks are from phishing, where the victim voluntarily provides his password. Finally, I am not an attractive enough target to justify the cost and time it would take a bad guy to make an individual attack. IMO the popular fashion for complex passwords, upper/lower case, numbers, special characters and minimum lengths is a defense against attacks that will never be made against me.
Yes, I too have a lot of passwords but very few of them have any importance. For unimportant passwords I use a very simple algorithm involving the site name. For sites that won't accept my simple password I use something more complex and permit my browser to save it. Unimportant sites include forums, weather and news sites, etc. -- places where a bad guy would find no benefit from succeeding in an effort to impersonate me.
So in the end I have well under ten passwords, all financially oriented, that I have to remember and even these are based on an algorithm. Of course, I do not permit browsers to memorize user names or passwords for these sites. I also minimize any traces of these sites on my phone contact list, phone browser bookmarks, and of course never load financial apps on my phone or tablet.
I am far more worried about someone sending a successful phishing expedition email to DW even though she is very careful. I am careful to, but someday might make a mistake. So I worry a little bit about that too.
The thing that makes any password manager so attractive is that a successful exploit could expose passwords and personal information of literally millions of users. That is a prize worth pursuing and at that point the complexity of those exposed passwords is irrelevant. The question of whether a popular password manager can be trusted has been answered by the LastPass exploit and the revelation that much of each user's information was being stored there as clear text.
