{"id":37,"date":"2026-11-02T19:43:55","date_gmt":"2026-11-02T19:43:55","guid":{"rendered":"https:\/\/privatepasswordgenerator.com\/blog\/?p=37"},"modified":"2026-11-02T19:43:55","modified_gmt":"2026-11-02T19:43:55","slug":"master-password","status":"publish","type":"post","link":"https:\/\/privatepasswordgenerator.com\/blog\/master-password\/","title":{"rendered":"How to Create a Master Password You Won\u2019t Forget (2027)"},"content":{"rendered":"<p data-lfile-container=\"d00c018c-3038-48a5-9d2d-b533bae831ec\" data-pm-slice=\"1 1 []\"><strong>Make your master password a passphrase of 6 to 8 random words, chosen by a generator from a large word list, then turn those words into a picture you can replay in your head.<\/strong> Something like <em>Glacier-Pumpkin-Ledger-Saddle47-Orbit-Tundra-Wobble<\/em> (an example only, never use a published one).<\/p>\n<p>Three rules make it work:<\/p>\n<ol>\n<li><strong>Let a generator pick the words.<\/strong> Words you choose yourself follow patterns that cracking tools already know.<\/li>\n<li><strong>Use a big word list.<\/strong> From the 7,776-word EFF list, each word adds about 12.9 bits of strength. Six words give about 78 bits, eight give about 103.<\/li>\n<li><strong>Rehearse it for two weeks, and keep one paper backup.<\/strong> A short memory routine turns random words into something you can type without thinking.<\/li>\n<\/ol>\n<p>Below is the reasoning, a full worked example on the <a href=\"https:\/\/www.privatepasswordgenerator.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Private Password Generator<\/a> Passphrase tab, and a plan for the day you blank on it anyway.<\/p>\n<p>&nbsp;<\/p>\n<h2 id=\"why-a-passphrase-not-a-complex-password\">Why a passphrase, not a complex password<\/h2>\n<p>Your master password is the one password you must type from memory. Every other password lives in your password manager, so those can be long random strings like <code spellcheck=\"false\">q7#Vm!2xLp9@Rt4z<\/code>. The master password cannot.<\/p>\n<p>A passphrase solves that trade-off:<\/p>\n<ul>\n<li><strong>Length does the work.<\/strong> NIST&#8217;s digital identity guidelines call for at least 15 characters when a password is the only protection on an account. A 6-word passphrase is usually 35 characters or more.<\/li>\n<li><strong>Words are easy to hold in mind.<\/strong> Your brain stores <em>Glacier, Pumpkin, Ledger<\/em> as three images. It stores <code spellcheck=\"false\">q7#Vm!2x<\/code> as eight unrelated symbols.<\/li>\n<li><strong>Strength is measurable.<\/strong> Because each word is picked at random from a known list, you can calculate exactly how strong the result is. That is not true of a password you invent.<\/li>\n<\/ul>\n<p>The catch: a passphrase is only strong if the words are truly random and the list is big enough. The next section shows how big.<\/p>\n<p>&nbsp;<\/p>\n<h2 id=\"how-many-words-do-you-need\">How many words do you need?<\/h2>\n<p><strong>Six to eight words, as long as they come from a large list like the 7,776-word EFF list.<\/strong> The number of words matters, but so does the size of the list they come from. Each word adds bits of entropy equal to log2 of the list size:<\/p>\n<pre spellcheck=\"false\"><code class=\"language-latex\">\\text{entropy (bits)} = \\text{words} \\times \\log_2(\\text{list size})<\/code><\/pre>\n<p>The EFF long list gives about 12.9 bits per word. Private Password Generator&#8217;s built-in list has 198 words, about 7.6 bits per word, which is why the tool itself recommends 8 or more words with the built-in list.<\/p>\n<table>\n<colgroup>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/><\/colgroup>\n<tbody>\n<tr>\n<th colspan=\"1\" rowspan=\"1\">Word list<\/th>\n<th colspan=\"1\" rowspan=\"1\">Words<\/th>\n<th colspan=\"1\" rowspan=\"1\">Entropy (bits)<\/th>\n<th colspan=\"1\" rowspan=\"1\">Tool rating<\/th>\n<th colspan=\"1\" rowspan=\"1\">Worst-case crack time<\/th>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">EFF long list (7,776 words)<\/td>\n<td colspan=\"1\" rowspan=\"1\">8<\/td>\n<td colspan=\"1\" rowspan=\"1\">103<\/td>\n<td colspan=\"1\" rowspan=\"1\">Excellent<\/td>\n<td colspan=\"1\" rowspan=\"1\">about 200 billion years<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">EFF long list (7,776 words)<\/td>\n<td colspan=\"1\" rowspan=\"1\">7<\/td>\n<td colspan=\"1\" rowspan=\"1\">91<\/td>\n<td colspan=\"1\" rowspan=\"1\">Strong<\/td>\n<td colspan=\"1\" rowspan=\"1\">about 27 million years<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">EFF long list (7,776 words)<\/td>\n<td colspan=\"1\" rowspan=\"1\">6<\/td>\n<td colspan=\"1\" rowspan=\"1\">78<\/td>\n<td colspan=\"1\" rowspan=\"1\">Strong<\/td>\n<td colspan=\"1\" rowspan=\"1\">about 3,500 years<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">Built-in list (198 words)<\/td>\n<td colspan=\"1\" rowspan=\"1\">10<\/td>\n<td colspan=\"1\" rowspan=\"1\">76<\/td>\n<td colspan=\"1\" rowspan=\"1\">Strong<\/td>\n<td colspan=\"1\" rowspan=\"1\">about 1,500 years<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">Built-in list (198 words)<\/td>\n<td colspan=\"1\" rowspan=\"1\">8<\/td>\n<td colspan=\"1\" rowspan=\"1\">61<\/td>\n<td colspan=\"1\" rowspan=\"1\">Fair<\/td>\n<td colspan=\"1\" rowspan=\"1\">about 2 weeks<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">Built-in list (198 words)<\/td>\n<td colspan=\"1\" rowspan=\"1\">6<\/td>\n<td colspan=\"1\" rowspan=\"1\">46<\/td>\n<td colspan=\"1\" rowspan=\"1\">Weak<\/td>\n<td colspan=\"1\" rowspan=\"1\">under a minute<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<p>Crack times use the generator&#8217;s own worst case: an attacker who stole a fast-hashed database and tests one trillion guesses per second. Password managers protect vaults with slow hashing, so real attacks are far slower. Still, a master password guards everything, so plan for the worst case.<\/p>\n<p><strong>Our recommendation:<\/strong> 7 words from the EFF list (about 91 bits) for most people, 8 words (about 103 bits) if you want to clear the 100-bit mark the tool suggests for anything that can be attacked offline. If you stay on the built-in list, use 10 words.<\/p>\n<p>&nbsp;<\/p>\n<h2 id=\"worked-example-a-7-word-master-passphrase-in-under-two-minutes\">Worked example: a 7-word master passphrase in under two minutes<\/h2>\n<p>This walkthrough uses the Passphrase tab on <a href=\"https:\/\/www.privatepasswordgenerator.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Private Password Generator<\/a>. Everything runs in your browser with its cryptographic random number generator, and nothing is sent or stored. If you want extra certainty, load the page, disconnect from the internet, then generate.<\/p>\n<ol>\n<li><strong>Open the Passphrase tab.<\/strong> Go to <a href=\"https:\/\/www.privatepasswordgenerator.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">privatepasswordgenerator.com<\/a> and click <strong>Passphrase<\/strong> at the top of the generator.<\/li>\n<li><strong>Load a bigger word list.<\/strong> Open <strong>Use my own word list<\/strong> and paste the <a href=\"https:\/\/www.eff.org\/dice\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">EFF long word list<\/a> (7,776 words). The dice numbers at the start of each line are ignored, and the entropy readout updates to about 12.9 bits per word.<\/li>\n<li><strong>Set Words to 7.<\/strong> The slider runs from 4 to 10 and starts at 6. Seven words lands at about 91 bits.<\/li>\n<li><strong>Pick a separator you can type fast.<\/strong> Hyphen is the default. Space reads most naturally if your password manager accepts it. Dot, underscore and none are also available.<\/li>\n<li><strong>Leave Capitalize words and Add a number on.<\/strong> They satisfy sites that demand uppercase letters and digits. The words carry the real strength; capitals on every word add none, and the number adds only a little.<\/li>\n<li><strong>Click Generate new and read the result.<\/strong> Check the entropy and crack-time readout under it. It is fine to click again a few times until you get a set you can picture. Picking one favourite from five rolls costs at most about 2 bits. Do not swap, reorder or edit words by hand.<\/li>\n<li><strong>Copy it and set it right away.<\/strong> Paste it into your password manager&#8217;s change-master-password screen, then write it on paper for your backup (see below).<\/li>\n<\/ol>\n<p>A result might look like this:<\/p>\n<blockquote><p><strong>Glacier-Pumpkin-Ledger-Saddle47-Orbit-Tundra-Wobble<\/strong> 7 random words from the EFF list, hyphen separator, capitalized, one number. Strength: about 91 bits before the number. Because this example is now public, treat it as burned.<\/p><\/blockquote>\n<p>Prefer the built-in list? Set Words to 10 instead. You get about 76 bits with no pasting, at the cost of three more words to learn.<\/p>\n<h2><\/h2>\n<h2 id=\"how-to-make-it-stick\">How to make it stick<\/h2>\n<p><strong>Turn the words into one strange scene, then recall it on a widening schedule for two weeks.<\/strong> Random words feel slippery at first. A vivid picture plus spaced practice fixes them in long-term memory.<\/p>\n<ol>\n<li><strong>Build a scene in word order.<\/strong> For the example: a <em>glacier<\/em> slides into a giant <em>pumpkin<\/em>, which cracks open to reveal an accounting <em>ledger<\/em> strapped to a <em>saddle<\/em> with the number 47 on it. The saddle rockets into <em>orbit<\/em> and lands on the <em>tundra<\/em>, where it <em>wobbles<\/em>. The sillier the scene, the better it sticks.<\/li>\n<li><strong>Say it, then type it 10 times on day one.<\/strong> Saying it out loud and typing it builds two memory paths. Type it into a blank text field you then clear, not a document you save.<\/li>\n<li><strong>Recall it on days 2, 4, 7 and 14.<\/strong> Each time, try from memory first, then check your paper copy. Most people have it cold by the end of week two.<\/li>\n<li><strong>Lock your password manager on purpose.<\/strong> Set the app to lock after a short idle time for the first month. Every unlock is free practice.<\/li>\n<li><strong>Remember the scene, not the spelling.<\/strong> If a word slips, replay the scene from the start. The next image usually pulls the missing word back.<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<h2 id=\"mistakes-that-make-a-passphrase-weak\">Mistakes that make a passphrase weak<\/h2>\n<ul>\n<li><strong>Choosing the words yourself.<\/strong> Favourite foods, pets, song lines and quotes are exactly what cracking tools try first. Only a random pick gives you the strength in the table above.<\/li>\n<li><strong>Too few words from a small list.<\/strong> Six words from a 198-word list is about 46 bits, rated weak. Either use a big list or add words.<\/li>\n<li><strong>Editing the generated words.<\/strong> Swapping in a word you like better, or reordering them, puts human patterns back in.<\/li>\n<li><strong>Leetspeak tricks.<\/strong> Changing <em>Pumpkin<\/em> to <em>Pumpk1n<\/em> adds almost nothing. Crackers try those substitutions automatically. Add a word instead.<\/li>\n<li><strong>Reusing it anywhere else.<\/strong> Your master password should unlock your password manager and nothing else. If one site leaks it, everything falls.<\/li>\n<li><strong>Saving it in your browser or a notes app.<\/strong> That defeats the point of a password you keep in your head.<\/li>\n<li><strong>Changing it on a schedule.<\/strong> NIST and the UK&#8217;s National Cyber Security Centre both advise against forced periodic changes. Change it only if you think it has been exposed or you shared it.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h2 id=\"your-backup-plan-if-you-do-forget\">Your backup plan if you do forget<\/h2>\n<p><strong>Write it down once, on paper, and store it somewhere physical and safe.<\/strong> Many password managers cannot reset a forgotten master password, because they never see it. A paper copy is the cheapest insurance you will ever buy.<\/p>\n<ul>\n<li><strong>Paper, not pixels.<\/strong> Write the passphrase by hand. Keep it with your passport or other important documents, or in a home safe.<\/li>\n<li><strong>Use your manager&#8217;s recovery tools.<\/strong> Many offer an emergency kit to print, recovery codes, or a trusted emergency contact. Set these up the same day you change your master password.<\/li>\n<li><strong>Turn on two-factor authentication.<\/strong> Then a stolen master password alone cannot open your vault. Store the 2FA recovery codes with your paper backup.<\/li>\n<li><strong>Test the backup.<\/strong> After two weeks, lock your manager and unlock it using only your memory. If you needed the paper, keep practising.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h2 id=\"frequently-asked-questions\">Frequently asked questions<\/h2>\n<h3 id=\"is-a-6-word-passphrase-enough-for-a-master-password\">Is a 6-word passphrase enough for a master password?<\/h3>\n<p>Yes, if the words come from a large list. Six words from the 7,776-word EFF list give about 78 bits, which the generator rates strong. Six words from a small 198-word list give only about 46 bits, so add words in that case.<\/p>\n<h3 id=\"should-i-use-spaces-between-the-words\">Should I use spaces between the words?<\/h3>\n<p>Spaces are fine if your password manager accepts them, and they are the most natural to type. Hyphens are the safest choice because nearly every system accepts them. The separator does not change the strength.<\/p>\n<h3 id=\"do-i-need-symbols-and-numbers-in-my-master-password\">Do I need symbols and numbers in my master password?<\/h3>\n<p>Not for strength. Adding one more word adds far more than a symbol. Keep <strong>Add a number<\/strong> on only so the passphrase meets any composition rules.<\/p>\n<h3 id=\"can-i-make-up-my-own-passphrase-from-words-i-like\">Can I make up my own passphrase from words I like?<\/h3>\n<p>No. Human-chosen words cluster around common, personal and memorable patterns, and attackers model those. Let the generator pick, then make the words memorable with a story.<\/p>\n<h3 id=\"is-it-safe-to-generate-a-master-password-online\">Is it safe to generate a master password online?<\/h3>\n<p>It is when the passphrase is created on your own device. Private Password Generator runs entirely in your browser and never sends the result anywhere. Use a device you trust, and you can go offline after the page loads.<\/p>\n<h3 id=\"how-often-should-i-change-my-master-password\">How often should I change my master password?<\/h3>\n<p>Only when you suspect it has been exposed, you shared it, or you reused it somewhere. Scheduled changes push people toward weaker, predictable passwords.<\/p>\n<h3 id=\"what-if-i-still-forget-it\">What if I still forget it?<\/h3>\n<p>Use your paper backup or your manager&#8217;s recovery option. If you have neither, most password managers cannot recover your vault. That is why the backup step matters.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Make your master password a passphrase of 6 to 8 random words, chosen by a generator from a large word list, then turn those words into a picture you can replay in your head. Something like Glacier-Pumpkin-Ledger-Saddle47-Orbit-Tundra-Wobble (an example only, never use a published one). Three rules make it work: Let a generator pick the &#8230; <a title=\"How to Create a Master Password You Won\u2019t Forget (2027)\" class=\"read-more\" href=\"https:\/\/privatepasswordgenerator.com\/blog\/master-password\/\" aria-label=\"Read more about How to Create a Master Password You Won\u2019t Forget (2027)\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-37","post","type-post","status-publish","format-standard","hentry","category-cyber-security"],"_links":{"self":[{"href":"https:\/\/privatepasswordgenerator.com\/blog\/wp-json\/wp\/v2\/posts\/37","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/privatepasswordgenerator.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/privatepasswordgenerator.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/privatepasswordgenerator.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/privatepasswordgenerator.com\/blog\/wp-json\/wp\/v2\/comments?post=37"}],"version-history":[{"count":3,"href":"https:\/\/privatepasswordgenerator.com\/blog\/wp-json\/wp\/v2\/posts\/37\/revisions"}],"predecessor-version":[{"id":40,"href":"https:\/\/privatepasswordgenerator.com\/blog\/wp-json\/wp\/v2\/posts\/37\/revisions\/40"}],"wp:attachment":[{"href":"https:\/\/privatepasswordgenerator.com\/blog\/wp-json\/wp\/v2\/media?parent=37"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/privatepasswordgenerator.com\/blog\/wp-json\/wp\/v2\/categories?post=37"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/privatepasswordgenerator.com\/blog\/wp-json\/wp\/v2\/tags?post=37"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}