Master Password Guide

Why the master password is different from all others

Every password you store in a password manager is protected by one credential: the master password. This creates a unique requirement: unlike every other password, you cannot store it in a manager — you must be able to recall it from memory. This makes the master password the one place where memorability and security must coexist, rather than memorability being traded away for security.

Why you cannot use your usual tricks here

A master password like "MyD0g$Buddy2019!" is a poor choice even though it seems personal and complex. The problem: it follows patterns that dictionary attacks test — common word, letter substitutions, special character appended, year at the end. More critically, if it is compromised, the attacker has every credential you have ever stored. The master password warrants the highest-quality approach, not the most convenient one.

Diceware: the right approach

Diceware is a method for generating passphrases using physical dice to select words randomly from a standardised list. The most widely used list contains 7,776 words (the number of possible outcomes of rolling five dice). Each word adds approximately 12.9 bits of entropy to the passphrase. A five-word passphrase achieves about 64.6 bits — adequate but on the lower end. A six-word passphrase achieves 77.5 bits — strong. A seven-word passphrase achieves 90.5 bits — very strong. Use at least six words for a password manager master password.

The key requirement: the words must be selected by actual random dice, not by human choice. Humans are terrible at selecting random words — we drift toward meaningful, related, or personally significant words, dramatically reducing entropy. Buy a set of dice and use the official EFF diceware list (eff.org/dice).

How to make a diceware passphrase memorable

Six or seven random words are easier to memorise than they sound. The human brain is excellent at constructing narratives and images. Take your randomly generated words and build a vivid mental image connecting them — the stranger and more absurd, the more memorable. Spend ten minutes visualising the scene, then practice typing the passphrase several times over the next few days. With daily use, the passphrase usually becomes automatic within a week or two.

What to avoid

Avoid: any phrase that is meaningful to you (a book quote, a song lyric, a personal motto), any modification of a word you already use as a password, any transformation of a word to make it "more secure" (replacing letters with numbers or symbols), or any passphrase under six words. Also avoid: using the same master password on multiple manager accounts, or using your master password for any other account.

Backup strategies

If you forget your master password, you lose access to your vault. A zero-knowledge manager generally cannot reset or recover your master password for you — that is the point. Strategies: write the passphrase on paper, store it in a physically secure location (safe, bank safety deposit box), and ensure a trusted person has access in an emergency. Some managers, such as Bitwarden (as a Premium feature), offer emergency access features that allow a designated contact to request access after a waiting period you set. For critical accounts, the physical backup is not paranoia — it is the appropriate response to the risk of losing access to every credential you have.

How your master password protects the vault

Your master password is not used directly as an encryption key. The manager runs it through a key derivation function that is deliberately slow, so that each guess costs an attacker real computing time. Bitwarden, for example, lets you choose between PBKDF2 and Argon2id and adjust the iteration count. A long random passphrase combined with a strong key derivation setting is what makes a stolen vault file impractical to crack.

Some managers add a second secret on top. 1Password generates a 34-character Secret Key on your devices and combines it with your account password, so that a memorable password alone is not enough to decrypt a stolen copy of your data. The trade-off is that you must keep the Secret Key safe, which is the purpose of its Emergency Kit.

Protect the account around the vault

A strong master password should not be your only barrier. Turn on two-step login for the manager account itself, using an authenticator app or a hardware security key, and store the recovery codes offline, away from the vault they protect. Unlock with biometrics for convenience, but expect to type the master password after a restart or a long period of inactivity, so keep practising it. If you ever suspect that your device was compromised, change the master password from a clean device, not the affected one.