How to Choose a Password - Computerphile

blibly:

How many words could I safely use for a passphrase if I, say, include an obscure fictional name and slightly misspell one of the words?

That will depend on your desired password bit strength and word list length as so:

import random
import math

word_list = ['insert', 'words', 'here']

BIT_STRENGTH = 128
word_space   = len(word_list)
combinations = 2 ** BIT_STRENGTH
words_in_pwd = math.ceil(math.log(combinations, word_space))

rng = random.SystemRandom()
password = ' '.join(rng.choice(word_list) for _ in range(words_in_pwd))

print(words_in_pwd)
print(password)

For EFF’s word list that has 7776 words, you need 10 words to exceed 128 bit entropy which is suitable for practically anything.

You might be able to get away with 10-20 bits less security if you use heavy Argon2id key derivation parameters, but outside KeepassXC master password, you don’t really get to fine-tune the Argon2 parameters.

But, you’ll only need to memorize 3-4 passwords:

• One FDE password for your computers’ operating systems, that’s only available to the LUKS decryption instance
• One root password for your operating system privilege escalation.
• One master password for your password manager’s database.
• Optionally, one password for FDE external drives.

The last one is there because you can probably restore access to your email and reset majority of online account passwords even if you’d lose access to all of your password databases. But you do not want to lose access to your files even in that event, so I’d recommend the fourth one.

Everything else should be managed by the password manager passwords. The passwords should be unique, and 128-256 bits strong. You don’t really have to care about length and charspace because the manager will remember them for you. Just use whatever chars are allowed by the service and adjust length until you hit the 128-256 area. It’s only if the service complains about password being too long, that you should really fine tune the types of characters used, like enable upper case, or even customize the punctuation marks used.

Also, make sure to adhere to best practices for password manager database backups:

• One backup on a second drive
• One backup on a permanently airgapped backup drive
• One backup outside your home, maybe at work or friend or relative’s house.