Making strong secrets · 5 min read
Choosing a master password
The master password guards every other password, and a copied vault can be attacked offline with no lockout. A random passphrase of six or more words gives a wide margin and is practical to memorize.
A password manager lets you use a long random password for every site while remembering only one: the master password. NIST’s SP 800-63B-4 notes that password managers “have been shown to increase the likelihood that subscribers will choose stronger passwords, particularly if the password managers include password generators.” The arrangement concentrates risk, though. That one password now protects everything else, so it deserves more care than any other.
Why it faces a harder attack than a website password
A website password is checked by the website, which can lock an account after repeated failures. A password manager’s vault is usually an encrypted file, stored on your devices and often synced through a server. The master password is turned into the encryption key by a deliberately slow function, a key-derivation function, chosen by the manager’s developers.
If someone obtains a copy of the encrypted vault, from a stolen laptop, a backup, or a breach of a sync service, there is no server to slow them down. They can guess offline for as long as they like. The only things standing in the way are:
- the number of possible master passwords, and
- the cost of each guess, set by the key-derivation function.
You control the first fully. The second varies between products and settings, and you may not know it. That is why the master password is the place to be generous.
EFF’s dice page names this use directly: a random passphrase is good “especially, for unlocking a password safe or password manager application.”
Worked example: how many words
Take random words from the EFF large wordlist, 12.925 bits each. Using this site’s illustrative attack rates:
| Scenario | Rate (assumed) | Situation |
|---|---|---|
| Online, rate-limited | 100 guesses per hour | a login form that slows down or locks out repeated failures |
| Offline, slow hash | 10,000 guesses per second | a stolen database hashed with a deliberately slow, salted scheme (bcrypt class) |
| Offline, fast hash | 100 billion guesses per second | a stolen database hashed with a fast unsalted hash (MD5, SHA-1 or NTLM class) on a high-end GPU rig |
The slow-hash rate, 10,000 guesses per second, is a reasonable stand-in for a vault protected by an expensive key-derivation function. The fast rate, 10^11 per second, stands in for a weak or poorly configured one. Neither is a measurement of any real product.
| Random EFF words | Bits | Average time at 10,000/s | Average time at 10^11/s |
|---|---|---|---|
| 4 | 51.70 | about 5,800 years | about 5.1 hours |
| 5 | 64.62 | about 45 million years | about 4.5 years |
| 6 | 77.55 | about 350 billion years | about 35,000 years |
| 7 | 90.47 | far longer | about 272 million years |
How the six-word row is calculated: 7,776^6 ≈ 2.21 × 10^23 possibilities; half of that, about 1.1 × 10^23, is the average search. At 10,000 guesses per second that is 1.1 × 10^19 seconds, about 3.5 × 10^11 years. At 10^11 per second it is 1.1 × 10^12 seconds, about 35,000 years.
The four-word row shows why the key-derivation function matters: the same passphrase is safe for millennia against an expensive function and lasts an afternoon against a cheap one. Six words hold up under both assumptions. EFF recommends “a minimum of six words” from its long list, and that is a sensible floor for a master password. Seven adds margin if the vault protects especially sensitive material. More detail is in how many words a passphrase needs.
Why random words, not a phrase you invent
All of the figures above require the words to be chosen at random, by dice or a cryptographic generator. A phrase you invent, such as a song lyric, a quotation, or a sentence about your life, is drawn from a much smaller and more predictable set, and its strength can’t be calculated. NIST’s Appendix A notes that “estimating entropy for user-chosen passwords is challenging.” See random vs human-chosen passwords.
Both ways of picking at random work:
- Dice. Five dice per word with the EFF list; the dice guide walks through it, and the wordlist page has a lookup.
- A generator. The passphrase generator draws the words with your browser’s cryptographic random number generator and runs entirely in the page.
Don’t reroll until you get words you like; it nudges the result away from random. Keep the words in the order they came.
Rules specific to a master password
Use it nowhere else. If the same phrase unlocks your email or any website, a breach of that site exposes the vault’s key. EFF: “Your passphrase should only be used for a single purpose.”
Don’t store it inside the vault it opens. It sounds obvious, but a vault entry for the master password is no help when you’re locked out.
Plan for forgetting. Many managers can’t recover a vault if the master password is lost, by design, because they never hold the key. EFF puts it plainly: “Forgetting this passphrase is also a serious risk which could result in permanently losing data.” Its suggestion is that some people may prefer to write it down, “especially while first trying to memorize it,” kept “in a safe place, not in the same place where the data it protects will be stored.” If the manager offers recovery codes or an emergency kit, the same storage rule applies; see recovery codes and backups.
Turn on a second factor for the account, if the manager has one. It protects the sync account, though it typically does not change how hard a copied vault file is to guess offline. See two-factor authentication explained.
Learning it
Six random words are easier to learn than they look. A few approaches people use:
- Make a scene. EFF suggests a “story, scenario, or sentence” that links the words in order. Its example for “panoramic nectar precut smith banana handclap” begins “The panoramic view, as I tasted the nectar of a precut granny smith apple…”
- Type it often at first. Unlocking the vault by typing rather than biometrics for the first couple of weeks gives regular practice.
- Keep the paper copy until it’s automatic, then store or destroy it as you’ve planned.
Changing it
There’s no need to change a strong master password on a schedule; NIST now says services “SHALL NOT require subscribers to change passwords periodically.” Change it if there is reason to think it’s known to someone else, such as if it was typed on a compromised device, as described in changing passwords regularly. Because a copy of the vault may already have been taken, a change protects future copies, so it also makes sense to change the most important passwords stored inside.
Note: No master password protects against malware on the device where you unlock the vault, since the vault is open there. Its job is to protect the vault when the device isn’t in an attacker’s hands.
For how password managers fit together more broadly, see password managers explained.
Sources
General explanation, not advice for a particular situation. Updated 2026-10-31.