How long should my master password be?

I believe there is a common misconception out there that a password MUST be random or have some random element in it to be secure. In truth, it only has to constructed so that it is not guessable - a random component ensures this, but it isn’t the only way. Any method that ensures a hacker must brute force your password (i.e., because it cannot be guessed) is fine. That’s why I think a combination of words in a phrase that are meaningful only to you (i.e., can’t be guessed) mixed with some capitals, some special characters, and some numbers are the absolute best choice. Because they are shorter than random passphrases of equal entropy, they are both easier to type in and more memorable.

Having said this, if you want to generate strong passphrases for passwords other than your master password in Bitwarden, say to secure website logins or such that you MIGHT need to type in at some point, I totally agree that using random words from a Diceware dictionary is a very good option.

1 Like