Choosing a master password for your password manager

Why the master password is a different problem

Every other password in this series is generated, stored and filled in by software. The master password is the exception: it is typed by a human, from memory, sometimes on a phone keyboard, and it is never stored anywhere by the manager itself. If it leaks, the whole vault goes with it — so it needs to be both strong and memorable, which two goals normally pull in opposite directions.

A passphrase is usually the right shape

A passphrase of unrelated words, separated by a character you can type easily, gives you a lot of entropy per unit of memory. With the full EFF large word list (7,776 words) each word contributes about 12.9 bits:

• 5 words ≈ 64 bits — acceptable if the vault uses a slow key-derivation function
• 6 words ≈ 77 bits — a good default
• 7 words ≈ 90 bits — comfortable, and still easy to type

Compare that with the classic advice of an eight-character string with a capital and a digit swapped in (P@ssw0rd!): that shape is not just weak, it is the first thing every cracking tool tries.

What to avoid

• Quotes, lyrics and famous lines. They are in every word list an attacker owns.
• Personal facts. Names, birthdays, street names and pet names are guessable by anyone who knows you — and often by anyone who reads your profile.
• Variations of an old password. If you are changing a leaked password, incrementing a number is not a change.
• A passphrase you have reused elsewhere. The master password must be unique. Nothing else should ever use it.

What to do instead

1. Open the generator and switch to Passphrase mode.
2. Choose 6 words, a separator you can type without looking (- is a good default), tick Capitalize so the shape is easier to read, and optionally append a number.
3. Press G or the generate button until the words are ones you can picture. You are not weakening the password by re-rolling — every output is equally random; you are just making it memorable.
4. Write it on paper once and put it somewhere physical, or store it in the vault itself and keep an offline copy in a safe. Do not put it in a cloud note or a chat message.
5. Type it from memory every day for the first week. After that you will not need the paper — but keep it anyway for the day you forget.

Two habits that matter more than the password

• Turn on two-factor authentication for the vault itself. A passphrase plus a second factor means a stolen passphrase is not enough.
• Rotate only on evidence. There is no reason to change a master password on a calendar schedule; change it after a breach notification, a phishing attempt, or if the paper copy may have been seen.

One honest caveat about this site

The entropy figures above assume a full-size word list. This site currently ships a smaller demonstration list, and its strength meter reports the real number for whatever list is bundled, so the bits you see are the bits you get. The production build will include the full EFF list. Either way, the password itself is created in your browser using the Web Crypto API — it never leaves your device.