# What is a master password?

> The single secret that unlocks a password manager, protecting every other credential it holds.

Last reviewed: 2026-09-01

## Master password

Category: Passwords

Also called: master key, primary password

Canonical page: https://moolkey.com/glossary/master-password

A master password is the one secret that unlocks a password manager. In a vaulted manager it decrypts the stored vault; in a deterministic manager it is an input to the calculation that recreates every other password. Either way, it is the only password you have to remember, and losing it is usually unrecoverable.

### What makes a good master password

It has to be strong enough to resist an offline attack and memorable enough that you will never forget it. Those requirements pull in opposite directions. A six-word random passphrase resolves the tension, giving roughly 62 bits in a form the human brain can hold.

It must also be unique. A master password reused anywhere else means one unrelated breach exposes everything.

### Why you usually cannot recover it

In a zero-knowledge design, the provider never receives your master password in any usable form, so there is nothing for support to reset. This is a deliberate property, not an oversight: if a provider could reset it, so could anyone who compromised the provider.

### What people often get wrong

Claim: "My password manager can email me a reset link if I forget it."

Correction: Some offer emergency access or recovery codes you set up in advance, but no zero-knowledge manager can recover the master password itself. If it could, its encryption would be reversible by the provider.

Further reading: [How to choose a master password](https://moolkey.com/blog/how-to-choose-a-strong-master-password)

### Sources

- [OWASP: Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html): Practical guidance for salts, peppers, PBKDF2, Argon2id, and password hashes.
- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.