Generate Master Password Password

Most password managers use zero-knowledge architecture, meaning they cannot recover your master password. If you forget it, you may lose access to all stored credentials permanently. Some managers offer emergency recovery options or emergency contacts. Write your master password down and store it in a physical safe or bank safety deposit box as a backup.

A passphrase (5-7 random words) is often recommended for master passwords because it can be memorized more easily while providing strong security. A 5-word Diceware passphrase provides about 64 bits of entropy. A random 20-character mixed password provides about 131 bits. Choose the approach you can reliably memorize — a forgotten master password is worse than a slightly shorter one.

Change your master password only if you suspect it has been compromised, if you entered it on an untrusted device, or if the password manager service reports a security incident. Routine rotation of master passwords increases the risk of forgetting it, which is a greater practical danger than the theoretical benefit of regular changes.

Biometrics (fingerprint, face) are convenient for daily unlocking but should supplement, not replace, your master password. Your password manager still requires the master password periodically and after restarts. Biometrics can be spoofed in targeted attacks and cannot be changed if compromised. Always maintain a strong master password as the primary security layer.