- What it is
- The secret string the login form asks for after the handle, held in one account and produced from material outside your own life.
- How you get one
- A password manager generates it, or you roll dice against a word list, then you write the result down before you use it.
- Where to keep it
- In a manager whose own secret you can reproduce, with a written copy in a physical place away from the machine.
- How it goes wrong
- Usually it turns out to be a variation of something you already use on an ordinary site with a login form and an email field.
- What fails without it
- You are shut out of an account that is still working perfectly, and your only route back is material written down beforehand.
- Time to acquire
- Generating one takes seconds. Making a copy you can find in six months takes an evening.
Derived from nothing, adapted from nothing
The failure mode is not weakness. It is derivation. People rarely invent a passphrase from scratch. They take one they already have and adapt it, adding a suffix, swapping a digit, changing the site name inside it. The result feels new and is not. Anyone holding one member of that family can guess the rest, and lists of leaked credentials from ordinary websites are where those family members come from.
So the property to hold onto is not length or symbol count. It is provenance. This string should have been produced by something outside your own preferences, used once, and left alone. A generator does that. Dice against a printed word list do that. Your memory of a phrase you like does not, however obscure the phrase feels.
Where it lives between sessions
There are two sensible homes and they work together. The first is a password manager, which removes the need to type or remember the string and makes reuse structurally awkward. The second is a written copy in a physical place, which covers the case where the manager itself becomes unreachable because the disk died or the machine was taken away.
Both homes have to be reachable from wherever you actually sit. A manager on a machine you cannot boot is not a home. A note in a place you visit twice a year is a home, but a slow one. The where things live page sets out the trade between speed and separation for material of this kind.
Knowing it is still the one that works
A written passphrase can drift out of date without anything visible happening. You change it during a session, mean to update the note, and do not. Six weeks later the note is confidently wrong and you have no way to tell by looking at it.
The only honest check is to use it. Log in with the written copy rather than the stored one occasionally, and the two versions stay in step. If typing the written copy fails while the stored one succeeds, the note is stale and needs replacing that day, not at some point.
The same check applies to the recovery material sitting beside it, since a stale note there is discovered even later and costs considerably more.
The failure that looks like something else
When a passphrase is wrong, the experience is a page that rejects you. People read that as the market having a bad day. They retype, wait, come back later, retype again, and eventually decide the address is at fault and go looking for another one. That is the moment a lot of accounts are lost and a fair number of people end up somewhere they did not intend to be.
Two things keep that from happening. A passphrase you can verify from your written copy, and a fingerprint you collected in advance so you can tell whether the page rejecting you is the one that should be. That second half is its own item and is the reason it exists.
One you can actually type
A passphrase you cannot type on a slow connection is a passphrase you will paste, and pasting has its own habits. Several ordinary words separated by spaces is easier to retype accurately than a shorter scramble of symbols, and easier to read back off paper without ambiguity between similar looking characters.
Legibility matters more here than it looks. The written copy is read under pressure, often once, often after a run of failed attempts, sometimes by lamplight. Whatever you write in the notebook should survive being read by a tired person who is already annoyed.
Questions that come up
Should the passphrase live in a manager or on paper?
Both, doing different jobs. The manager is the working copy: it types the string for you, keeps it out of your muscle memory and makes accidental reuse difficult. The paper copy is the fallback for the day the manager is unreachable, which is usually a hardware failure rather than anything dramatic. Holding only one of the two leaves an obvious single point of failure that people discover at the worst moment.
How often should it be changed?
Changing it on a schedule for its own sake mostly produces stale written copies and small variations on the previous string, which is the derivation problem again. Change it when there is a reason: a machine you no longer trust, a manager you have stopped using, a suspicion that something was watching you type. Then update the written copy in the same sitting, before you close the session.
What if the same passphrase is already on another site?
Then it is not this artifact yet, and you should treat the account as reachable by anyone holding that other site's leaked data. Generate a fresh one, change it, write the new one down, and note the date. The old string stays dangerous for as long as it is in use anywhere, so the fix has to include the other places rather than stopping at this one.