Master password
Your master password is the only key that unlocks your password manager. If you lose it and have no backup, nobody — not even the company behind the manager — can recover what's inside.
- What it is
- The key that encrypts your vault
- Since
- 1997
- Verdict
- Yes
What it is
The master password is the key your password manager uses to encrypt and decrypt your entire vault. It's never stored on any server in plain text: a properly built manager doesn't know it, it only checks that the one you type produces the same encryption key. That's why, if you forget it without a recovery backup, there's no "reset password" that works: the content stays encrypted forever.
Day to day, many people replace typing it with Face ID, a fingerprint, or their phone's PIN. That's convenient, but it isn't the same thing: there's still a master password underneath, and if it only lives in your biometrics and you lose your phone, you have no way to type it on another device.
When it was introduced
The idea goes back to the first encrypted password manager, Password Safe, by Bruce Schneier (1997): all its content was protected with a single master key encrypted with the Blowfish algorithm. It's the same principle used today by Bitwarden, 1Password, iCloud Keychain, or Google Password Manager.
Why it's used
It lets you remember one strong password instead of dozens of weak or reused ones. It's the trade-off that makes having a different password for every account actually workable.
The flip side: it becomes a single point of failure if it only exists in your head and on your phone at the same time, with no backup at all. Forget it and lose the phone on the same day, and you lose access to everything it protected.
Should you use it?
It has to live in your head, not just in your face or your fingerprint. Make sure you can type it from memory on any device, without looking anything up.
Check this
- Do you know your master password without looking at your phone or the manager?
- Do you always log in with Face ID or your fingerprint, and haven't typed it in the last year?
- Do you have any recovery backup of that password stored outside your phone?
Official sources: Password Safe project history