Why this is the one password nobody can reset
Every other password in your vault can be reset by the website that issued it. The master password cannot. Bitwarden says its employees and systems have no way to retrieve or reset it. 1Password says no one can reset your account password. NordPass says no data in your account can be accessed without your Master Password, and its only self-service escape hatch is the 24-character Recovery Code you were asked to save at signup.
It is also the password most worth attacking. If a vendor database were ever copied, the encrypted vault could be attacked offline by guessing master passwords, at whatever speed the attacker can afford. Length and randomness are what make that impractical.
The method: six random words
The EFF dice method: roll five dice at once, read the digits in order, and look up the word next to that five-digit number in the EFF long wordlist. Repeat until you have six words. EFF suggests a six-word passphrase for most uses and says the more words you use, the stronger it gets. The randomness comes from the dice, not from you, which is the point: EFF notes that people are poor at making unpredictable choices.
If you do not have dice, use the passphrase option in your manager password generator; 1Password advises that the best password is one you do not choose yourself, and Bitwarden offers a passphrase generator. Keep the words in the order generated. Add a separator such as a space or hyphen if you like; NIST says verifiers should accept spaces and all printing characters.
Worked example: five words or six?
The EFF long list has 7,776 words (6 to the fifth power, one per five-dice combination), and each randomly chosen word adds about 12.9 bits. The arithmetic below is ours, based on those published figures. The guessing speed is a round illustrative assumption, not a measured figure, and real speed depends heavily on the vault KDF settings.
| Words | Possible passphrases | Approximate entropy | Time to try all at an assumed 1 billion guesses per second |
|---|---|---|---|
| 4 | about 3.7 quadrillion (3.7 x 10^15) | about 52 bits | about 42 days |
| 5 | about 28 quintillion (2.8 x 10^19) | about 65 bits | about 900 years |
| 6 | about 2.2 x 10^23 (EFF: roughly 2 to the 77th) | about 77 bits | about 7 million years |
| 7 | about 1.7 x 10^27 | about 90 bits | tens of billions of years |
What the standards and the vendors say
NIST SP 800-63B-4 sets a minimum of 15 characters for a password used on its own (8 when it is only one part of multi-factor authentication), says systems should allow at least 64 characters, and says they shall not impose composition rules such as mandatory symbols or require periodic changes unless there is evidence of compromise. A six-word passphrase with separators will almost always clear the 15-character minimum; count yours to be sure.
| Question | Bitwarden | 1Password | NordPass |
|---|---|---|---|
| Minimum or rules | At least 12 characters for master passwords created after release 2023.3.0 | No specific requirements for numbers, symbols or capitals | Support guidance: at least 12 characters with a mix of character types |
| Extra protection | Optional breach check against Have I Been Pwned when changing it (sends a hash only) | 128-bit Secret Key combined with the password | Separate Nord Account password for login |
| Generator | Passphrase generator with word-count and separator options | Recommends a generator-suggested password | Built-in password generator |
| Hint | Optional hint, emailed to the account address on request | None described | None described |
| If forgotten | Not resettable; recovery only through emergency access, org recovery or another unlocked device | Not resettable; family organizer, admin or recovery code if set up | Reset with your Recovery Code |
Never do this
- Reuse a password you have used anywhere else, even with a number added. NordPass and NIST both stress uniqueness, and NIST requires checks against known compromised passwords.
- Pick your own words or a quotation. Song lyrics, sayings and family names are exactly what guessing tools try first.
- Use the same password for the NordPass Master Password and the Nord Account password; NordPass recommends they differ.
- Store the master password inside the vault it unlocks, in a notes app or in an email to yourself.
- Fill in a Bitwarden hint that gives the answer away. NIST says systems shall not let unauthenticated people see hints; if you use one, make it meaningless to anyone else.
- Change it on a schedule for no reason. NIST says periodic changes should not be required; change it if you suspect someone saw it.
Where to keep an emergency copy
1Password recommends writing your account password on at least one printed Emergency Kit and keeping it in a safe deposit box or with your passport or birth certificate, and optionally giving a copy to someone you trust. NordPass offers the Recovery Code as a PDF download and says to save it somewhere safe. Bitwarden has no kit, so write the passphrase on paper yourself, store it the same way, and add an emergency access contact.
How to change it later in each vault
- Bitwarden web app: Settings, Security, Master password tab. Browser extension: Settings, Account security, Other options, Change master password. Desktop: Account menu, Change master password.
- 1Password: sign in at 1Password.com, select your name, Manage Account, Change Password. Then print a new Emergency Kit and write the new password on it.
- NordPass desktop or Web Vault: Settings, Security tab, Change Master Password. Mobile: Profile, Settings, Change Master Password. Consider generating a fresh Recovery Code afterwards under Settings, Reset Recovery Code.
Questions before you decide
How many words should a master passphrase have?
Six random words from the EFF long wordlist, which EFF recommends for most uses. That gives roughly 77 bits of entropy and is usually well over the 15-character minimum NIST sets for single-factor passwords.
Do I need symbols and capital letters in my master password?
Not for strength. NIST says systems shall not impose composition rules, and 1Password says its account password has no requirements for numbers, symbols or capitals. Length and randomness matter far more.
Is it safe to write my master password down?
On paper, stored offline, yes. 1Password recommends writing it on a printed Emergency Kit kept in a safe deposit box or with your passport. Do not store it in a digital note or email.
Can Bitwarden reset my master password if I forget it?
No. Bitwarden says it has no way to retrieve or reset it. Recovery depends on routes you set up in advance, such as emergency access or organization account recovery.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- EFF: dice-generated passphrases Accessed 30 Oct 2026
- EFF: new wordlists for random passphrases Accessed 30 Oct 2026
- NIST SP 800-63B-4: authentication and authenticator management Accessed 30 Oct 2026
- Bitwarden: your master password Accessed 30 Oct 2026
- Bitwarden: forgot master password Accessed 30 Oct 2026
- 1Password: choose a good account password Accessed 30 Oct 2026
- 1Password: about your Secret Key Accessed 30 Oct 2026
- 1Password: change your account password Accessed 30 Oct 2026
- 1Password: get to know your Emergency Kit Accessed 30 Oct 2026
- NordPass: what is a Master Password? Accessed 30 Oct 2026
- NordPass: how to set up the Master Password Accessed 30 Oct 2026
- NordPass: what if I forgot my Master Password? Accessed 30 Oct 2026
- NordPass: how to change my Master Password Accessed 30 Oct 2026
- NordPass: how to generate a new Recovery Code Accessed 30 Oct 2026
- NordPass: how to use Password Health Accessed 30 Oct 2026
- Bitwarden: Username and password generator Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.