Your master password: create it, store it and never lose it

Your master password is the key to your entire vault. With Proton Pass and 1Password, your vault is encrypted on your own device. The provider doesn't know your password, so it can't reset it for you the way an ordinary website can. If you forget it and haven't made any arrangements, you could lose all your passwords.

Which password is your master password?

• Proton Pass: the password of your Proton account. You can also set an extra password just for Pass (see Securing Proton Pass: two-step login, extra password and locking).
• 1Password: your 1Password account password. It comes with a Secret Key of 34 characters that 1Password creates for you. You don't need to memorise this key, but you do need to keep it safe (see Creating a 1Password account on 1password.eu).

How to create a good master password

1. Create a passphrase of five or six random words, for example desk-summer-cable-tulip-oven-square. Don't use this example yourself.
2. Let a generator choose the words (see Generating strong passwords and passphrases), not you. A line from a song, a proverb or your children's names are easy to guess.
3. Use this password nowhere else, not even in a slightly altered form.

How to make sure you never lose it

• Write it down on paper and keep it in a safe place at home, for example with your passport. The Dutch NCSC is fine with this: you should memorise your master password well, write it down and store it safely. Don't note what it's for.
• Practise it every day for the first few weeks. Type it in instead of unlocking with your fingerprint until you're sure you know it.
• Keep your recovery details with the paper: your recovery phrase for Proton (see Securing Proton Pass: two-step login, extra password and locking), and your Emergency Kit with your Secret Key for 1Password (see Creating a 1Password account on 1password.eu).
• Set up emergency access in case you're no longer around or your password really is lost (see Arrange emergency access in case you are no longer around).
• Make a backup of your vault (see Making a backup or export of your vault).

Where to type it, and where not to

• Only type your master password in your password manager's own app or browser extension, or on the genuine website: account.proton.me or pass.proton.me for Proton, and your own address on 1password.eu for 1Password.
• Does an email or a website ask you to enter your master password? Don't do it. Open the app yourself.
• Turn on automatic locking, for example after a few minutes of inactivity. You'll then need to open your vault again with your password, your PIN or your fingerprint.

Please note: Two-step login on your account is a good idea, but it's no reason to use a shorter master password. If your password manager's provider is ever hacked and encrypted vaults are stolen, only your master password (together with your Secret Key for 1Password) protects your vault. The Dutch NCSC says so too: the extra layer of security doesn't justify a weak master password.

Have you forgotten your master password after all? Read Forgot your master password? What you can still do.