Your vault passphrase is the one password you must remember. CISA recommends at least 16 characters that are random, either mixed characters or a passphrase of 4 to 7 unrelated words. Make it unique to the vault, never reuse it, and back it up in a form only you and your emergency contact can reach.
What CISA says
Passwords should be at least 16 characters, and longer is stronger. They should be random, using a random string of mixed case letters, numbers and symbols, or a passphrase of four to seven unrelated words, which is easier to remember. Each account needs its own password, because reuse is how one breach exposes others.
CISA says most people cannot remember unique, long, random passwords for every account and advises against writing them down or saving them in a file. A password manager generates, stores and fills passwords and flags weak or reused ones. You then remember one strong password for the manager itself, ideally a passphrase.
Build a good one
- Pick words at random. Use dice and a word list, or the generator in a trusted tool. Do not choose words because they feel meaningful.
- Use at least four words, five or six for high value vaults.
- Avoid quotes, lyrics and names. Anything a stranger could guess after reading your social media is out.
- Make it unique. The vault passphrase should appear nowhere else.
- Type it a few times the first day, then daily. Muscle memory holds it quickly.
CISA's range of four to seven words is its stated guide. Choose the upper end for an executive's vault.
Back it up the right way
- A sealed copy in a safe place, such as a home safe or with your lawyer, for your emergency contact.
- Not in your phone notes or a cloud document.
- Not in the same place as your spare security keys, if one loss would give both away.
See our digital legacy plan for who should hold the sealed copy.
Add a second layer
A passphrase alone is one factor. Turn on multi-factor sign in for the vault if it supports it, using a passkey or hardware key, as in why you need two security keys.
What to do with the old passwords
When you move into a manager, change the passwords for your email, bank, healthcare and social accounts first, replacing them with generated ones. CISA also suggests checking whether important sites enforce strong password rules and asking why if they accept short passwords or dictionary words.
Do not rotate for sport
We have not verified a source in this post for regular forced changes. Change the vault passphrase if you suspect exposure, not on a calendar. Our post on NIST password rules explains why.
Quick check
How long should the vault passphrase be?
CISA says at least 16 characters, and gives four to seven unrelated words as an easier to remember form.
Is it fine to store the passphrase in a notes app?
No. Keep a sealed physical copy in a safe place instead.
Sources
Last reviewed: 19 October 2026.
