What makes a good vault passphrase?
Getting started · Help center · Current as of 2026-10-10
Short answer
Twelve characters is the minimum the app enforces, and four unrelated words beat a short dense password every time. The attack that matters is an offline one: anyone who obtains a copy of your encrypted vault or backup file can guess at it for as long as they like, and every extra word multiplies what that costs them. Record it somewhere durable, because no reset exists.
Why length rather than symbols
Your passphrase is stretched with scrypt before it unwraps anything, which makes each guess expensive instead of free. That buys time, not immunity: a ten-character password with a digit on the end is still a short list to work through. Four or five unrelated words are easier to type, easier to remember, and enormously longer.
What the strength hint means
- Too short — under 12 characters. This is the one hard rule, and it stops you creating the vault.
- Weak: too repetitive — one character repeated, or fewer than five distinct characters in the whole thing.
- Fair or Good — long enough, with obvious room left to improve.
- Strong — 20 characters or more, or four words or more.
Everything above the minimum is advice, not a gate. The hint is computed on your device and reaches no server.
Where to keep it
A password manager is a sensible place for the passphrase, and so is paper somewhere safe. What should not go in the password manager is the 2FA secrets themselves, which is the reason they are here instead. Do not reuse a password you use elsewhere, and read what cannot be recovered before you rely on the vault.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms