🔑 Password Security Guide

Generate passwords with KeePassXC or a comparable offline password manager rather than composing them yourself — a password you feel is "random" almost always follows patterns from your own habits and language, and cracking tools are tuned specifically for that kind of human predictability. Set the generator for at least 20 characters mixing uppercase, lowercase, numbers, and symbols. The alternative worth knowing is Diceware: physical dice rolls selecting words from a published word list produce a passphrase that's both high-entropy and, unlike a random character string, actually memorable — four to six words gets you into a comparable entropy range to the 20-character option while being something you can type from memory under pressure. Either method beats anything you'd invent on the spot, because the whole point is removing your own brain's predictable shortcuts from the process.

An encrypted KeePassXC database, locked behind one strong master passphrase you actually memorize, is what makes generating a unique 20-character password per account practical instead of a burden — you're only ever remembering one thing. Keep the database file on encrypted storage — an encrypted USB drive or Tails Persistent Storage — and never on a cloud-synced folder, since that turns a single provider breach into access to every credential you own at once. Set auto-lock to trigger after a short idle window (2-5 minutes is a reasonable default) so a database left open on an unattended screen doesn't stay open indefinitely. The auto-type feature (Ctrl+Shift+U) types credentials directly rather than routing them through the clipboard, which matters because clipboard-sniffing malware specifically watches that clipboard for anything that looks like a password or seed phrase. Back the database up to a second encrypted device — a password manager with no backup turns one lost or corrupted drive into losing access to everything at once.

Never write a password down in a plain-text file or note on your computer — a database entry behind encryption and a scrap of readable text sitting in your documents folder provide completely different levels of protection for the exact same information. The same goes for sharing one over an unencrypted message, even briefly, even to someone you trust; the message sits on a server somewhere the moment you send it. Rotating market passwords every 30-60 days is a reasonable baseline, but a breach notice from any market you use should trigger an immediate change regardless of your regular schedule — that's the one case where waiting for the routine rotation costs you real exposure time. Stack every available protection rather than treating a strong password as sufficient on its own: 2FA, PGP-based login, and a PIN each cover a different failure mode a password alone doesn't, and together they mean one leaked credential isn't the same as one compromised account.