How to create a strong passphrase you can actually remember
One of the nicest things about using a password manager is that you can stop trying to remember a different password for every website. But there are still a few secrets you may need to type yourself, such as a passphrase you use to unlock the password manager itself.
That's a good use for a memorable passphrase. For website logins, let your password manager generate and store a new, random, unique password for each account. There's no need to memorise those.
So how do you make one that's strong enough to protect your data, but that you can actually remember?
The short answer: let a secure generator choose a sequence of random words, then learn those words in order. Our passphrase generator starts with six words and does the choosing for you.
There's a small but important detail here: random words.
Why not just make up a sentence?
A passphrase is still a password. Using several words gives you room for more characters without having to memorise a jumble of letters and symbols. But length alone doesn't tell the whole story.
A favourite lyric or a familiar saying may be long, but someone trying to guess passwords can try those too. Adding an exclamation mark at the end doesn't make the underlying phrase unpredictable.
Choosing words independently avoids that familiar pattern. They don't need to make sense together. In fact, you might end up with something rather strange:
huddle-upturned-afflicted-tree-kiwi-catfight
I generated this example from the same wordlist our tool uses. Don't use it as your own passphrase — it's now published on the internet for everyone to see 😉.
How many words should you use?
The Electronic Frontier Foundation recommends at least six randomly selected words for a password manager or disk encryption. That's the starting point I've used for our generator.
The tool draws from EFF's list of 7,776 words. With six independently selected words, there are 7,776⁶ possible sequences. An attacker can know the entire wordlist and still have to work out which sequence you received.
Adding another random word increases that number of possibilities. Capitalising every word or switching hyphens to spaces doesn't add another random choice in the same way. Those options are useful for readability or meeting a website's requirements, but the randomly chosen words do the main work.
There isn't a useful universal answer to “how many years would this take to crack?” It depends on how the password is protected and how quickly an attacker can test guesses. I'd rather explain how the phrase is generated than promise a countdown.
Try it with the passphrase generator
Here's how to create your own:
- Open the Secrets passphrase generator. It generates a six-word phrase automatically.
- Use Number of words if you want a longer phrase. The tool supports up to ten words.
- Choose a Word separator that's comfortable to type and accepted wherever you'll use it. Hyphens are the default; spaces, periods and underscores are also available.
- If the service requires them, use Capitalize words or Add a random number.
- Copy the result and save it securely before relying on your memory.
The page downloads the wordlist, then selects words using your browser's cryptographically secure random generator. The generated phrase isn't uploaded or saved by the page.
If you'd prefer to do this away from a computer, EFF also explains how to generate a passphrase with dice.
Remember the words you received
Once you have your phrase, try imagining a scene that links the words in order. With the example above, you might picture a huddle around an upturned tree, with an afflicted kiwi watching a catfight. A rather unfortunate day for the kiwi, but perhaps an easier image to remember than the text itself.
Build the image around the words you received. Replacing them with a quote you already know would undo the random selection.
Practise typing the exact phrase, including its separators and capitalisation. While learning it, you can keep a written copy somewhere physically secure. For a passphrase that unlocks your password manager, make sure your only copy isn't inside the vault it unlocks.
If you're using a passphrase to unlock Secrets, also take a moment to set up recovery. Remembering your passphrase and having a way to recover access are both worth planning for.
Let your password manager handle website passwords
A memorable passphrase is useful for unlocking a password manager such as Secrets. Once you're inside, let the app do the remembering for you.
For each website, generate a new random password and save it with the login in your password manager. Secrets can generate and store these passwords on Mac and iPhone, so you can use a different one everywhere without having to learn any of them.
Keep the passphrase you use to unlock your password manager separate from all those website passwords. Reusing it on a website would put it at risk if that service exposed it.
Secrets can also work without a passphrase
There's one more thing worth mentioning: Secrets doesn't require you to set up a passphrase at all. On supported devices, you can choose to unlock it using just Touch ID or Face ID.
Your data is still encrypted. Secrets encrypts your vaults with a random 256-bit key, which is itself encrypted using device keys stored in Apple's Keychain. With biometric-only unlocking, access to those device keys is protected by the device's Secure Enclave and authorised by a successful fingerprint or face match. Apple's Keychain access controls enforce that protection.
You can choose a different unlock method on each device, depending on how you use it. Our Securing your secrets support article explains the available options and how to set up recovery in case you ever lose access.
If you choose a passphrase, the passphrase generator can help you create one. And whether you unlock with a passphrase or biometrics, Secrets can look after the passwords you don't need to remember.