Your master password is the one secret that unlocks a password manager or digital vault. In Hypervault it is also used to derive the encryption keys for the data you store. We do not store it and cannot reset it. That makes “a good master password” more important than any other credential you keep.
What is a good master password?
A good master password is:
- Long. Aim for at least 14 characters; 16+ is better for a vault that holds business secrets. A four-to-six word passphrase is often stronger and easier to type than a short jumble.
- Unique. Never reuse it on email, Microsoft 365, banking, or social media. If that other account is breached, the vault goes with it.
- Unpredictable. No names, birthdays, company names, keyboard walks (
qwerty), or a single dictionary word with a!at the end. - Memorable to you, not to others. You should be able to type it without looking it up in a chat log or a note on the same laptop.
- Paired with MFA. A strong master password plus two-factor authentication stops most phishing and credential-stuffing attacks.
If you cannot invent one by hand, use a strong password generator and practise typing it until it sticks—or use a passphrase you can recall.
Master password vs ordinary account passwords
Ordinary site passwords should be random, unique, and stored in the vault. You should not memorise them.
The master password is the opposite: you must remember it (or keep a sealed recovery copy offline). It is the key to every other secret. Treat it like a physical safe combination, not like a website login.
How to create one
- Prefer a passphrase of unrelated words (for example a short sentence you did not copy from a book or song), or a generated string of 16+ mixed characters.
- Check it against the rules above. Avoid anything searchable about you or your company.
- Enable MFA on the vault immediately.
- Write a recovery copy once, store it in a physical safe or with a trusted emergency process—not in email, Slack, or the vault itself.
- Generate other passwords with a manager so you never reuse the master password elsewhere.
Hypervault organisation admins can still plan recovery for the company (emergency kits, named admins). That does not replace a strong personal master password for accounts that use one.
What a bad master password looks like
CompanyName2026!- A reused Gmail or Microsoft password
- A 8–10 character “complex” password you recycle
- Anything stored in the same browser profile as autofill for that vault
Length beats clever substitutions. Tr0ub4dor&3 is weaker in practice than a long, unique passphrase.
