Most password advice optimizes for the wrong variable. It tells you to add a symbol, capitalize a letter, swap an ‘o’ for a zero — and then treats the result as strong because it's hard for a person to read. None of that is what makes a key hard to guess. What makes it hard to guess is entropy: how many possibilities an attacker has to search through before they land on yours.
A twelve-character password drawn from letters, digits, and symbols has roughly 95^12 possible combinations — a huge number on paper. But real passwords aren't drawn evenly from that space. People reuse patterns: a capital letter at the start, a symbol at the end, a year somewhere in the middle. Cracking tools are built around exactly these patterns, so the real search space is far smaller than the math suggests.
Why four random words beat eleven random characters
A passphrase built from four words picked independently from a large word list — something like correct-horse-battery-staple — has entropy that's easy to calculate honestly, because each word is chosen from a known, large set with no pattern for a cracker to exploit. Four words from a 7,776-word list is roughly 7,776^4 combinations, which lands well above what a twelve-character mixed password achieves in practice, while staying genuinely memorable.
This is exactly why Velora Vault's master key has no upper character limit and doesn't enforce symbol or capitalization rules. Length is what we're asking for. A long passphrase you can actually recall beats a short password you have to write down.
- Pick four to six words that aren't a known phrase, lyric, or quote.
- Add a number or a made-up word if you want extra margin — not because a rule demands it.
- Never reuse your master key anywhere else. It's the one key that unlocks everything else.
- Write it down once, on paper, and store that paper somewhere your vault doesn't live.
One more thing worth saying plainly: Velora cannot recover your master key if you lose it. That's the tradeoff for it never touching our servers. Treat the passphrase you choose today as something you'll need to remember, or safely record, for as long as you use the vault.