Master password and very long forgetful master password

You’re missing the point I’m making and thinking I’m changing the subject, so let me start over.

Imagine you end up naked in the desert. You try to log into your Bitwarden account, you know the master password but are stopped at the 2FA screen. You don’t have your Yubikey or your recovery code because it was too long to remember.

Without either your Yubikey or your recovery code you’re forever locked out of your Bitwarden account. Bitwarden will not turn off 2FA if you lose it.

As you can see, knowing your master password does not help you if you also don’t remember your recovery code too. Your recovery code and 2FA secret, which is in your Yubikey, are randomly generated codes. If 2 of the 3 things that you need to get in your account are random and you don’t put them to memory then what difference does it make to also make your master password random too? Unless you turn off 2FA, which most say you should have 2FA, there is no benefit to memorizing your master password.

The same logic you have about needing 2FA to get in your account is the same logic we have about our master password; It’s a rare event and mostly done on new devices.

If I need my master password I don’t go to my safe, I unlock my phone and get it from there. I keep a copy of my master password in my Bitwarden vault which most people should do especially after the BitSwarden event. All my devices use a PIN unlock that Bitwarden has so it’s rare I need to enter my master password. The only real time I need it is if I’m signing into a new device. I do have a copy in the safe as most people should but its rare it gets to that point.

I’m not making my life harder than it needs to be, it’s quite the opposite. I use PIN unlock so getting into my account is easy. It’s also quite relieving not having to remember another password. Knowing my master password is so complex that I don’t even know it is very nice too as I know if Bitwarden is breached I’m good on the cracking side of things. And if they are breached it’s just a matter of me pressing a button to get a new password, no need to spend time learning a new one. I also have emergency access setup if the worst happens.

I haven’t seen a good point about remembering a master password. I’m willing to have my mind changed but I’ve spent too much time thinking about this stuff and this is where I’ve ended up.