How Often Should You Change Your Master Password? 

You've heard before that your master password should be a good one. After all, you created it to protect all your other passwords. But how often should you change your master password? Or can you use the same one forever? Let's review how to be savvy when using a password manager to keep your information safe, including how often you should change your master password.

How a master password is different

A master password isn't just any old password. It's the password—the one you use to secure your password manager. With your master password, you unlock your online accounts and loads of personal information, essentially your entire digital life. So you'd never want to forget it - and you want to treat it extra carefully. A master password should be unique in every sense of the word. It should not be a password you've ever used before. It should not be a word or phrase that someone could find in a dictionary or popular movies, books, shows, etc. It should not be something guessable. It should be something you've created, especially for your password manager. The best master passwords are passphrases. That means the password combines words in unique ways that have personal meaning to you while being meaningless to others. A mix of character types - like uppercase, lowercase, numbers, and symbols - strengthens the password and adds to its uniqueness. And it's long - at least 12 characters, but ideally 16+. The longer the password, the harder it is for hackers to crack it. So a passphrase like "Ilovechocolatec00kiedoughicecream" is easier to remember and type and a lot harder for someone to break. NIST's recent password recommendations support these best practices (and apply to all passwords, not just master passwords).

When you should change a master password

If you already have a long, unique passphrase for your master password, then you'll be happy to hear that you don't have to change your master password very often, if at all. That's because you're already following best practices, and your master password is very safe from common cybersecurity threats. Frequently changing passwords is proven to result in poor passwords. When people have to keep making up new passwords, they start making them easier to remember. So you should hardly ever change your master password; essentially, only when there's a security reason to do so. The only times you should change your master password are when: 

1. You logged in to your password manager on a device infected with spyware or other malware. If there is any chance that malicious software captured your master password, update it ASAP. Be sure to do so on a clean, trusted device.

1. You were a victim of a phishing scam that somehow tricked you into sharing your master password.

1. You have other reasons to believe hackers compromised your password manager account and/or leaked your master password to the dark web.

But remember, the above scenarios can also be mitigated by turning on two-factor authentication for your password manager account. That's why it's crucial to have a strong master password and put several layers of security in place to protect yourself online. A strong master password provides a good foundation of cyber security, but you should use it alongside other security measures for the best results.

Staying security savvy

Using a password manager and creating a strong master password to log in to said password manager goes a long way towards improving your cybersecurity. However, going a step further to review your online security practices and putting a few more safeguards in place can make all the difference in keeping hackers and spammers out of your accounts and away from your personal information. So, after you've double-checked that your master password is strong, here are a few more steps to take:

• Generate all passwords: Using a password generator will make each one random, free of personal information, and tough to crack. The password generator built into your password manager makes it easy to replace all passwords with strong, unique ones. 
• Store everything in an encrypted vault: Your password manager is a digital safe that employs strong encryption and extra security to protect your data. As long as you know your master password, you - and only you - have access to everything in your vault.
• Steer clear of phishing: Know the signs of phishing attacks and only use a password manager to log in to accounts since it will only fill in passwords to URLs saved in the user's vault. If even one letter is off in the URL, the password manager will not automatically fill in the correct password – keeping users safe from themselves.
• Turn on multi-factor authentication: MFA adds a critical layer of security to your password manager. MFA requires more information before granting access, which can slow down an attack or completely stop a hacker. Use MFA everywhere possible, especially on email, banking, and credit card accounts.  
• Monitor the dark web: Select a password manager that provides dark web alerts so you know when the websites you frequent have had a data breach. Stay ahead of hackers and change passwords as soon as possible.
• Periodically review your password security strategy: Security evolves. As hackers change tactics, cyber security best practices can change, too. Review your plan at least once a year and keep improving. 

A password manager is an essential part of a personal cybersecurity strategy. And a good master password is critical to using a password manager. When you follow best practices to create a long, unique master password, you can feel confident in using that password until you have reason to believe it's at risk. Learn more about how a password manager and a strong master password can help you create a personal cybersecurity strategy that is convenient and effective.