Your master password is the one secret guarding all the others. This how-to, part of our password managers guide, shows you how to choose one that can stand up to an attacker who has a copy of your vault.
Why this password is different
Most passwords only have to resist a website's login page. A master password may have to resist something tougher. If a provider's servers are hacked, an attacker can try guesses against your encrypted vault on their own computers, with no lockouts. See what if my password manager gets hacked.
That is why it needs to be stronger than anything else you use.
Use a passphrase
Random words are the best fit, since you have to type this one by hand and remember it. Here is the method:
- Get a word list, such as the EFF long list, along with five dice.
- Roll all five dice and look up the word for that number.
- Repeat until you have six or more words.
- Join them with spaces or hyphens.
Your manager's generator can also make a word-based passphrase for you. Our article on passphrases vs passwords explains why this works and shows the numbers.
What makes a master password bad
| Avoid | Why |
|---|---|
| A password you already use | A leak elsewhere could open your vault |
| Family names or dates | Easy to research |
| A favorite quote or lyric | Attackers try these |
| Fewer than five words | Too little margin for an offline attack |
How to remember it
Type it every day for the first couple of weeks. Do not let fingerprint unlock do all the work at first, because the practice is what makes it stick. Making up a silly scene that links the words can help.
Keep a backup
Most providers cannot reset your master password. So keep a written copy, stored somewhere safe and away from your computer, along with any emergency kit. Keep it out of the vault itself, since you cannot open a vault with a password locked inside it. Read about emergency access and backups.