If I type my password twice (like: PwdThingPwdThing), OR type every character twice (like: PPwwddTThhiinngg) will that make it substantially more secure than it already is?
Assume that it is already 8 or 9 characters, consisting of upper and lower case, digits and one or more special characters.
(Also assume that I didn't tell anyone that I am doing it this way, although I just told the world... Doh!)
I ask because I would like more security in a way that I can still remember, and this would be an easy change to make and recall.

Let's try skipping theory and going straight to practice.

Will typing the same word twice (or N times) substantially help?


John the Ripper Jumbo has a variety of "simple rules" about this


d duplicate: "Fred" -> "FredFred"
f reflect: "Fred" -> "FredderF"

oclHashcat rules based attack has simple rules just for this, too


d  Duplicate entire word   d   p@ssW0rd    p@ssW0rdp@ssW0rd 
pN     Append duplicated word N times  p2  p@ssW0rd    p@ssW0rdp@ssW0rdp@ssW0rd
Reflect    f   Duplicate word reversed     f   p@ssW0rd    p@ssW0rddr0Wss@p 

Therefore, no, this bit of cleverness is so common it's included explicitly in both common rulesets already for use by itself, or in combination with other rules.


OR type every character twice


John the Ripper Jumbo has an example specifically about this in the documentation


XNMI extract substring NM from memory and insert into current word at I is the core rule
"<4X011X113X215" (duplicate every character in a short word) is the example in the documentation to cover exactly your case for short passwords



.


oclHashcat rules based attack has simple rules just for these kinds of attacks


q  Duplicate every character   q   p@ssW0rd  pp@@ssssWW00rrdd
zN   Duplicates first character N times   z2   p@ssW0rd   ppp@ssW0rd
ZN   Duplicates last character N times   Z2   p@ssW0rd    p@ssW0rddd
XNMI  Insert substring of length M starting from position N of word saved to memory at position I    lMX428    p@ssW0rd     p@ssw0rdw0

Therefore, no, again, this is such a common bit of cleverness that it's called out explicitly in both major open source cracking products.


Assume that it is already 8 or 9 characters, consisting of upper and lower case, digits and one or more special characters. 

The other rules in those products very likely cover everything you're doing already, and it's also likely that whatever combination you have is already included in a ruleset applied to a reasonable cracking wordlist.


oclHashcat alone comes with twenty five different files full of .rules, including d3ad0ne.rule with more than 35,000 rules, dive.rule with over 120,000 rules, and so on.
a large number of wordlists are available, some of which may include your exact password - the Openwall wordlist alone has a single 500MB file of more than 40 million words including mangled ones
and I'm personally aware of both small, very good wordlists (phpbb, et all) and huge, comprehensive wordlists with literally billions of entries, taking up many gigabytes of space total.


As with everyone else, you need to use try randomness or something like an entire sentence worth of personal anecdote that does NOT use words in a top 5000 list of common English words, and does use long, uncommon words (to force combinatorial attacks using much larger dictionaries).

Specifically look, for example, for words selected at (good) random included in Ubuntu's insane english ispell dictionary list that are not included in the standard english ispell dictionary, for example.
