[nrr]

I'm not and never have been NSA, but I nonetheless have a sordid past with what is arguably a related line of work. This is how I manage my passwords.

In environments where regular rotations are required, I print off a new "biscuit" via `(date ; pwgen $PWGEN_FLAGS) | lpr`. I then append to the candidate password something of a personal identifier that only I know.