Your master password: create it, store it and never lose it

Your master password is the key to your entire vault. With a good password manager, your vault is encrypted on your own device using that password. The maker of the manager doesn't know it, so they can't reset it for you either. If you forget it, in the worst case you lose all your passwords.

How to create a good master password

1. Create a passphrase of five or six random words, for example desk-summer-cable-tulip-oven-square. Don't use this example yourself.
2. Let your password manager's generator choose the words (see Generating strong passwords and passphrases), not you. A line from a song, a proverb or your children's names are easy to guess.
3. Use this password nowhere else. Not even slightly altered.

Bitwarden requires at least 12 characters for your master password. A passphrase of five or six words is much longer, and that's the idea.

How to make sure you never lose it

• Write it down on paper and keep it in a safe place at home, for example with your passport. The Dutch NCSC is fine with this: you should memorise your master password well, write it down and store it safely. Don't write down what it's for.
• Practise it every day for the first few weeks. Type it instead of unlocking with your fingerprint until you know it by heart.
• Keep your recovery code. Turn on two-step login for your Bitwarden account and you'll get a recovery code. Keep it with the piece of paper (see Securing your Bitwarden account with two-step login).
• Set up emergency access in case you're no longer around or your password really is lost (see Arranging emergency access in case something happens to you).
• Make a backup of your vault (see Making a backup or export of your vault).

Where to type it and where not to

• Only type your master password in your manager's own app or browser extension, or on your vault's website (for Bitwarden in the EU: vault.bitwarden.eu).
• Does an email or website ask you to enter your master password? Don't do it. Open the app yourself.
• Turn on automatic locking, for example after a few minutes of inactivity. You then have to open your vault again with your master password, your PIN or your fingerprint.

Please note: Two-step login on your vault is good, but it's no reason for a shorter master password. If the maker of your manager is ever hacked and encrypted vaults are stolen, only your master password protects your vault. The Dutch NCSC says so too: the extra layer of security doesn't justify a weak master password.

Have you forgotten your master password after all? Read Forgotten your master password: what can you still do?.