Table of Contents
Your master password is the single most important credential you will ever create. It protects every other password, secure note, credit card number, and sensitive document stored in your vault. Get it right, and your vault is essentially impenetrable. Get it wrong, and the strongest encryption in the world cannot save you. This guide, part of our Password Manager Guides & Tutorials series, teaches you how to create a master password that is both genuinely strong and reliably memorable.
What Is a Master Password?
A master password is the one password that unlocks your password manager. Every login, note and card in your vault is encrypted with a key derived from it, which makes it the only password you still have to remember – and the one you cannot afford to lose.
What Makes a Master Password Different
A master password is not like other passwords. With regular account passwords, your password manager generates random strings of 20+ characters and remembers them for you. You never need to type them or recall them from memory. Your master password is the exception – it must live in your head.
This creates a tension between security and memorability. A random string like x7#Kp2$mQ9!wL4&n is strong but nearly impossible to remember. Your dog’s name followed by your birthday is easy to remember but trivially guessable. The solution lies in understanding what actually makes a password strong.
The Math Behind Password Strength
Password strength is measured in bits of entropy – essentially, how many guesses an attacker would need to crack it. Each bit of entropy doubles the number of possible guesses. To make that concrete, picture an attacker testing a trillion guesses per second, roughly what a rig of eight high-end GPUs manages against a fast hash like MD5. Trying every possibility would take:
- 40 bits of entropy: About a second
- 60 bits of entropy: About two weeks
- 80 bits of entropy: Tens of thousands of years
- 100+ bits of entropy: Billions of years
Those are worst-case numbers. A KeePass vault does not use a fast hash: it runs your master password through a deliberately slow key derivation function (Argon2 in PanicVault), which cuts the attacker’s guessing rate drastically. But the margin only helps if the password itself has real entropy.
The key insight is that entropy comes from randomness, not complexity. A 12-character password mixing uppercase, lowercase, numbers, and symbols has about 79 bits of entropy – if every character is truly random. But humans are terrible at being random. We pick dictionary words, substitute letters predictably (@ for a, 3 for e), and follow patterns that attackers know well.
The Passphrase Method: Your Best Option
The most effective technique for creating a strong, memorable master password is the passphrase method: string together several randomly selected words.
How It Works
- Get a list of common English words (the EFF diceware list contains 7,776 words)
- Randomly select 5-7 words from the list
- String them together as your passphrase
For example: marble kitchen voltage planet anchor tulip
This passphrase has approximately 77 bits of entropy (with 6 words from a 7,776-word list). That is stronger than most “complex” passwords people create and far easier to remember.
Why Random Selection Matters
The randomness is critical. If you pick words that form a logical sentence (“my dog loves running outside daily”), the entropy drops dramatically because attackers can use language patterns to narrow their guesses. The words must be randomly chosen – ideally using dice rolls, a random number generator, or your password manager’s built-in generator.
Making It Memorable
Once you have your random words, create a mental image or story that connects them. The more vivid and absurd, the better. “A marble kitchen on a planet with voltage anchors growing tulips” is nonsensical but memorable because it is visual and unusual.
Practice typing your passphrase several times. Most people find that after 5-10 repetitions over a day or two, the passphrase becomes automatic – your fingers remember the sequence even when your conscious mind hesitates.
Step-by-Step: Creating Your Master Password
Option A: Using PanicVault’s Generator
- Open PanicVault on your iPhone, iPad, or Mac
- Open the password generator from the key icon in the entry list toolbar (Cmd+G on Mac)
- Switch to passphrase mode, which draws words from the EFF long wordlist
- Set the word count to 5-7 (PanicVault allows 3 to 10; the default is 5)
- Generate several passphrases until you find one you can visualize
- Practice typing it before committing to it
Option B: Using Dice (Maximum Randomness)
This method guarantees true randomness because physical dice cannot be biased by software.
- Download the EFF Large Wordlist (search “EFF diceware word list”)
- Roll five dice for each word you need (each combination of five dice maps to one word)
- Look up each result in the word list
- String the words together
- Practice until it is memorized
Why Not Just Three Words and a Number?
Shorter shortcuts like harvest-prism-copper-42 are tempting, but three random words from a 7,776-word list give only about 39 bits (each word adds about 12.9), and a number you picked adds only a few more, because attackers try the common ones first. That is well short of the five-word minimum. For the one password that guards everything, use the full passphrase.
What to Avoid
Common Passwords and Patterns
These are the first things attackers try:
- Dictionary words on their own (“sunshine”, “password”, “football”)
- Keyboard patterns (“qwerty”, “1qaz2wsx”)
- Sequential numbers or letters (“123456”, “abcdef”)
- Common substitutions (“p@ssw0rd”, “l3tme1n”)
Personal Information
Attackers often research their targets. Avoid:
- Names of family members, pets, or significant others
- Birthdates, anniversaries, addresses
- Phone numbers, license plates
- Favorite sports teams, musicians, or movies
- Anything someone could find on your social media profiles
Previously Used Passwords
If you have used a password anywhere else, it may already be in a breach database. Never reuse a compromised credential as your master password. Check haveibeenpwned.com if you want to verify.
Sentences and Quotes
“ToBeOrNotToBe” feels clever but is easily guessable because it follows known text. Song lyrics, movie quotes, Bible verses, and famous sayings are all in attacker dictionaries.
Testing Your Master Password
Length Check
Your master password should be at least 16 characters long. Passphrases of 5+ words typically exceed this easily. If yours is shorter, add another word.
Uniqueness Check
Your master password must not be used anywhere else. Period. This is the one credential that protects all others. If an attacker obtains it from a breach at some other service, they own your entire vault.
Memorability Check
Can you type your master password correctly three times in a row without looking at a reference? If not, practice more before relying on it. There is no password reset for your master password in local password managers like PanicVault and KeePass – if you forget it, your data is gone.
Shoulder-Surfing Check
Can you type your master password quickly enough that a casual observer could not read it over your shoulder? Passphrases are slightly more vulnerable here than random character strings because words are recognizable. If this concerns you, practice typing quickly or ensure you unlock your vault in private. On Apple devices, Face ID and Touch ID handle most daily unlocks, so you only type your master password occasionally.
After You Create Your Master Password
Write It Down – Temporarily
This is controversial advice, but it is practical. When you first create your master password, write it on a piece of paper and keep it in a physically secure location (a safe, a locked drawer – not under your keyboard or on a sticky note on your monitor). This is your backup while you are still memorizing it.
Once you have typed your master password enough times that it is completely automatic (usually a week or two), destroy the paper – or keep it on purpose.
Should You Keep a Written Copy?
For most people, forgetting the master password is a bigger risk than someone breaking into a safe. A sheet of paper in a locked safe or a safe deposit box is out of reach of remote attackers, and it is often what lets your family into your accounts in an emergency. If you keep one, do not label it “master password” or name the app, and remember who else can open that safe.
If you share your home with people you do not fully trust, keep a hint instead of the passphrase: a memory cue for each word that means nothing to anyone else. It jogs your memory without handing over the key.
Practice Daily
For the first two weeks, deliberately type your master password rather than using biometric unlock. This reinforces the muscle memory. After two weeks, you can switch to Face ID or Touch ID for daily use, but keep typing it from memory regularly so you do not forget it. PanicVault does this for you: even with biometric unlock on, it asks for the master password every 14 days by default (under Master Password Re-entry in Settings you can choose every 7, 14 or 30 days, or every unlock).
Consider a Key File (Advanced)
For maximum security, some KeePass-compatible managers including PanicVault support key files – a second factor stored as a file on your device. With a key file enabled, an attacker needs both your master password and the specific key file to unlock your vault. This is the password equivalent of a deadbolt and a combination lock on the same door.
The tradeoff is that you must manage the key file carefully. If you lose it and do not have a backup, you lose access to your vault just as surely as if you forgot your master password. See our guide on KeePass key files for details.
Changing Your Master Password
You should change your master password if:
- You suspect someone may have observed you typing it
- You accidentally shared it (even partially)
- You used it somewhere else (never do this, but if you did, change it immediately)
- You wrote it down and the paper was lost or potentially compromised
You do not need to change your master password on a regular schedule. A strong passphrase that has not been compromised remains strong indefinitely. Frequent changes lead to weaker passwords because people simplify to accommodate the churn.
How to Change It
In PanicVault:
- Unlock your vault and tap the gear icon in the entry list toolbar to open Database Settings
- In the Master Password section, tap Change Master Password
- Enter your current master password
- Enter and confirm your new master password, then tap Change Password
PanicVault re-encrypts the vault with the new password and saves it. A vault on iCloud Drive or Google Drive uploads automatically, and the key Face ID or Touch ID uses is updated too. Your other devices will ask for the new password the next time they unlock.
Make sure to update any backups of your database after changing your master password. Old backups still open with the old password, so a backup made before the change is only as safe as the password you replaced.
What Happens If You Forget Your Master Password
With a local password manager like PanicVault or KeePassXC, nobody can reset it – not Apple, not the app developer. The vault is encrypted with a key derived from your master password, and no copy of that password exists anywhere else. If you forget it, the data is gone: you create a new vault and reset your accounts one by one. This is a feature, not a bug – the same property keeps anyone who steals the file out – but it means you must take memorization seriously.
Cloud managers differ only in what you set up in advance. In 1Password, a family organizer or team administrator can recover a member’s account. Bitwarden cannot reset a master password, but a trusted contact you added through its Premium emergency access feature can request access to your vault (Bitwarden). Neither helps if it was not set up before you forgot.
For a KeePass vault, preparation is the only recovery plan:
- Keep typing it. Let PanicVault’s re-entry prompt do its job instead of setting it to the longest interval.
- Keep a written copy or a hint somewhere safe (see above), or a sealed emergency kit for the people who would need your passwords.
- Back up the vault file and any key file. A backup cannot fix a forgotten password, but losing the file or the key file locks you out just as surely. See How to Back Up Your Password Vault.
FAQ
Should I use a password manager to store my master password?
No. Your master password is the one password that must live only in your head (and optionally on a physical backup in a secure location). Storing it digitally creates a circular dependency.
Is a longer passphrase always better?
Up to a point. A 6-word passphrase from a 7,776-word list provides about 77 bits of entropy, which is excellent. An 8-word passphrase provides about 103 bits. Beyond 8 words, the additional security is theoretical – you are already safe against attacks that will not exist for decades. The practical limit is how many words you can reliably remember and type.
Can I add spaces between the words in my passphrase?
Yes. Spaces are just another character. “marble kitchen voltage” is marginally stronger than “marblekitchenvoltage” because it includes two space characters. More importantly, spaces make the passphrase easier to read and type. Some password managers’ master password fields do not accept spaces – if yours does not, use hyphens or no separator.
What about passphrases in other languages?
Passphrases work in any language. If you are a native speaker of a language other than English, using words from that language adds a small amount of additional security since most attacker dictionaries are English-heavy. The same rules apply: choose words randomly, not logically.
