Entropy is the only number that matters
Password strength is measured in bits of entropy: the base-2 logarithm of the number of equally likely possibilities the password was drawn from. Every extra bit doubles the number of guesses an attacker needs on average. Eight random lowercase letters are 26^8 possibilities, about 37.6 bits. Twelve characters chosen uniformly from the 95 printable ASCII characters give roughly 78.8 bits.
The catch is the word random. A human-chosen password like Summer2024! looks varied, but attackers do not guess uniformly; they guess a common word, a year and a trailing symbol, in that order. Against a real cracking rig its effective entropy is closer to 25 bits than to the 70 the character count suggests. Strength comes from how the password was generated, not from how it looks.
VaultMemo's strength meter estimates bits conservatively and refuses passwords below about 30. Treat that as a floor. For a vault you rely on, aim for 60 bits or more.
Why complexity rules failed
For two decades the standard advice was a mix of uppercase, lowercase, digits and symbols, changed every ninety days. In 2017 NIST's Digital Identity Guidelines (SP 800-63B) dropped both composition rules and scheduled rotation, and the 2024 revision states it more firmly: length matters, arbitrary complexity does not, and forced changes make passwords worse.
The reason is behavioural. Faced with a rule, people apply the same transformations: capitalise the first letter, put a digit and an exclamation mark at the end, swap a for @ and o for 0. Cracking tools ship with those rules built in, so P@ssw0rd1! falls almost as fast as password. Complexity that everyone adds the same way adds almost no entropy.
Passphrases and diceware
A passphrase is a password made of several random words. Diceware, published by Arnold Reinhold in 1995, makes the randomness explicit: you roll five dice, look up the resulting number in a list of 7 776 words, and repeat. Each word drawn this way contributes log2(7776), about 12.9 bits. Five words give 64.6 bits; six give 77.5, which is more than enough margin for a vault.
The words must be chosen by chance, not by you. Picking your favourite four nouns yields a phrase that reads like a passphrase but is drawn from a much smaller, more predictable pool. Use real dice with a printed list (the EFF long wordlist is a good one) or a generator you trust to be local. Separators, capitalisation and a digit are optional and add little; length in words is what counts.
Memorability comes from imagery. correct horse battery staple is famous because it is easy to picture. Say your phrase aloud, type it ten times on the first day, and it will stick within a week.
The arithmetic against PBKDF2
Consider an attacker with a copy of your vault and a high-end GPU. Public benchmarks for PBKDF2-HMAC-SHA256 put a single modern card at roughly ten billion HMAC iterations per second in aggregate, which at 600 000 iterations per guess means on the order of a few tens of thousands of password guesses per second. Call it 20 000.
At that rate a 30-bit password (about a billion possibilities) falls in about half a day on one card. A 45-bit password takes on the order of fifty years for the same card, or a few months for a rack of a hundred. A 64-bit passphrase needs around 2 × 10^19 guesses: tens of millions of years for the rack. The iteration count moves every line of that table by the same factor; the password decides which line you are on.
Numbers like these age. GPUs get faster and the iteration count that is reasonable today will be raised tomorrow. A passphrase with margin, six words rather than four, is cheaper than ever needing to re-encrypt in a hurry.
What to avoid
Reuse is the biggest single risk. A password that has appeared in any breach is in the cracking dictionaries now, whatever its length. Give the vault a password used nowhere else. Personal details (names, dates, pets, streets), song lyrics, famous quotes and keyboard walks such as qwertyuiop are in the dictionaries too, because they are exactly what people choose.
Avoid the opposite failure as well: a random string of twelve symbols that you will never recall. A master password that ends up on a sticky note on the monitor is protected only by the lock on your front door. A written copy is fine, even wise, if it lives in a drawer, a safe or a sealed envelope with someone you trust.
No recovery, by design
There is no forgot-password link because there is nothing to send one to. VaultMemo never stores the password or the key derived from it, so a reset would mean a back door, and a back door for you is a back door for everyone. The verifier can tell whether a password is right, but it cannot say what the password is.
Plan for it on day one. Write the passphrase down and store the paper somewhere physical. Export an encrypted backup once you have a few notes, and test restoring it in a private window. If you ever suspect the password has been seen, change it from the vault settings: every note is re-encrypted under a new key, and old backups keep opening with the old password until you replace them.
