There is no need to even break the codeword as it is the same for every site. In the above example say we want to guess their gmail password, it is probably:
sh(/J3HqAfQsu.?u.??
OTOH this is only relevant for targeted attacks where the attacker has one password. This still protects you pretty well from bulk attacks (so long as the card is not widely used) and is miles better than re-used or poor passwords at little usability cost.