The One Passphrase Setup: Why Your Password Manager Deserves a Great Master Secret

You do not need to memorize 200 passwords. You need to memorize exactly one great passphrase, and let software handle the rest. Here is the setup I recommend to friends, with the reasoning behind every piece.

Last year I helped my dad set up a password manager. He is in his seventies, types with two fingers, and had been using the same password, a variation of his dog's name plus a year, on roughly 40 sites. I did not lecture him. I set up Bitwarden, generated one six word passphrase as his master password, wrote it on an index card he keeps in his desk, and had him practice typing it ten times. Two weeks later he called to tell me he had changed his bank password to something the manager generated. That is the whole game: make the one memorized secret excellent, and make everything else the computer's problem.

The architecture: one key, one vault

Think of it as a house. The password manager is a safe that holds 200 unique, random, 20 character keys, one per site. The master passphrase is the combination to the safe. The safe's encryption is only as strong as that combination, because an attacker who steals the encrypted vault, which happened to LastPass in 2022 when attackers captured an employee's master password through malware, can hammer on it offline at billions of guesses per second.

This is why the master passphrase is the one place where human memorability and cryptographic strength have to coexist. Every other password in your life can be a random string you never see. This one you will type every day, possibly for years, so it needs to be typable and memorable while carrying serious entropy. A six or seven word diceware passphrase is the standard answer, and the math backs it up: six words gives about 77.5 bits, which resists offline brute force for millions of years at a trillion guesses per second.

What I actually recommend, step by step

1. Pick a reputable manager. Bitwarden is free and open source, and its free tier is generous. 1Password costs about $3 a month and has excellent family sharing for five users. Either is fine. The manager you will actually use beats the theoretically perfect one you abandon.

2. Generate a 6 or 7 word passphrase as the master secret. Use a generator that runs locally in your browser with crypto.getRandomValues(), not a server side tool that could log what it made. For the master password specifically, I go to 7 words. It is one extra word to memorize and it multiplies the attacker's work by 7,776.

3. Practice typing it 20 times before you commit. This is the unglamorous step everyone skips. Muscle memory is what makes a passphrase durable. Type it, lock the vault, type it again. By the twentieth time your fingers know it.

4. Write it down once, on paper, in a safe place. Security orthodoxy used to say never write passwords down. For the master secret, a sealed envelope in a fireproof safe, or a copy with a trusted family member, is reasonable estate planning. What you must not do is store it in a notes app, an email draft, or a spreadsheet. Paper cannot be phished.

5. Let the manager generate everything else. From now on, you never invent a password again. Every account gets a unique random string of 16 to 20 characters from the manager's generator. Reuse is how one breach turns into ten; the manager makes reuse unnecessary.

6. Turn on two factor authentication everywhere it matters. An authenticator app is good. A hardware security key like a YubiKey is best. Never use SMS as the only second factor on your vault if you can avoid it.

The trade offs nobody mentions

Cloud vs local vaults. Bitwarden and 1Password sync through the cloud, which means convenience and also means your encrypted vault sits on someone else's server. KeePass keeps everything local, which removes the server entirely but puts backup and sync on you. For most people, a cloud manager with a strong master passphrase is the right trade: the encryption is the protection, and a 7 word passphrase makes the encrypted blob practically uncrackable.

Passkeys are coming for some of this. Where sites support passkeys, use them; they sidestep the password question entirely and are phishing resistant. But passkeys do not cover everything yet, and your manager still needs its master passphrase. This setup is not going away.

The single point of failure is real. Yes, everything depends on one secret. That is the point, and it is why that secret gets the royal treatment: maximum entropy you can memorize, written backup on paper, second factor on the vault. A single well defended point of failure beats 200 weak ones scattered across the internet.

What not to do

Do not use a passphrase you composed yourself from meaningful words. "My dog's name is Max and he is 7" is predictable. Do not use song lyrics or quotes; attackers test those. Do not generate your master passphrase on a random website that might log it; for this one secret, local generation matters. And do not paste real passwords into online strength checkers that send them to a server. Assume anything you typed into an untrusted site is compromised.

Frequently asked questions