Your master password is the one password you have to remember, and it protects all the others. That makes it worth five minutes of care, once.
What makes it strong
A password is strong when an attacker would need an enormous number of guesses to find it. Two things decide that number: how long it is, and how unpredictable each part is. Clever substitutions like p@ssw0rd add almost nothing, because guessing tools try them first.
The US standards body NIST says the same thing in its 2025 digital identity guidance: passwords used on their own must be at least 15 characters, systems should accept at least 64, and forced rules about symbols and capitals should go, because they push people towards predictable patterns.
The method: random words
- Let something random choose the words. Dice, or a passphrase generator. Words you pick yourself tend to be related, which makes them easier to guess.
- Use four to six words. Four random words from a large list is already strong; five or six is better for a master password.
- Join them with a separator. A hyphen or a space is fine. Add a number if a site insists, but the words do the real work.
- Never reuse it. If this phrase has been used anywhere else, a leak there is a key to your vault.
Example of the shape only, not one to copy: harbor-velvet-quill-tundra-58. Make your own with a generator, so nobody else has seen it.
Making it stick
Picture the words as one silly scene, then type the phrase every day for the first week. Most people stop thinking about it within days. Face ID and Touch ID save you typing it daily afterwards, but the app will still ask for it from time to time, which keeps it fresh.
Plan for the day you forget
Because a well-built password manager never has your master password, nobody can reset it for you. Zen Passwords gives you three ways back that you control: a recovery key, a printable Emergency Kit, and social recovery, where any three of five people you trust can restore your access together.
Questions
How long should a master password be?
At least 15 characters. NIST's 2025 guidance requires 15 characters for passwords used on their own, and a phrase of four or five words passes that easily.
Should I add symbols and capital letters?
They help a little, but length and randomness help much more. NIST no longer recommends forcing symbols, because people respond with predictable patterns.
Can I write my master password down?
On paper, kept somewhere safe at home, yes. An Emergency Kit is designed for exactly that. Never store it in a note on your phone or in an email.