How to Choose a Strong Encryption Password

An encryption password protects data in a fundamentally different situation than the password on an online account. A website can lock an account after a few wrong guesses. An encrypted file cannot: anyone who obtains a copy can run guessing software against it on their own hardware, around the clock, with no lockouts and no alerts.

That difference means encryption passwords should generally be stronger than typical account passwords. The good news is that strength comes mostly from length and randomness, and both are easy to get right with the right approach.

Why offline attacks change the math

SecretPNG derives encryption keys with PBKDF2-HMAC-SHA-256 at 600,000 iterations, which makes every password guess computationally expensive. This slows attackers down by orders of magnitude, but it cannot make a weak password safe. If your password is a dictionary word with a number on the end, it will fall within the first few million guesses regardless of how slow each guess is.

Guidance from NIST's Digital Identity Guidelines points in the same direction for passwords generally: length matters more than forced complexity rules, and the most damaging choices are common, predictable passwords.

The easiest strong option: a random passphrase

A passphrase is a sequence of words chosen at random from a large list. SecretPNG's passphrase generator uses the EFF Large Wordlist of 7,776 words, the same list designed for the Diceware method. Each randomly chosen word adds about 12.9 bits of entropy, so a six-word passphrase provides roughly 77 bits, which is far beyond what offline guessing can realistically search when the key derivation is slow.

The critical word is 'random'. A phrase you invent, a song lyric, or a favorite quotation is not random: attackers train their guessing tools on exactly that kind of material. Let the generator, or physical dice with the EFF list, pick the words for you.

Random character passwords

If you prefer a compact password, a randomly generated string of 16 or more characters drawn from letters, digits, and symbols is also excellent. SecretPNG's password generator creates these locally in your browser. Character passwords are harder to type and memorize than passphrases, so they are best suited for storage in a password manager rather than memory.

What to avoid

Most password failures come from predictability rather than insufficient symbols. Avoid these patterns for anything protecting encrypted data.

• Reusing a password from any online account, especially one that may have appeared in a breach.
• Personal details such as names, birthdays, pet names, or addresses, alone or in combination.
• Keyboard walks and simple substitutions, like 'qwerty123' or 'P@ssw0rd'.
• Short passwords, even random ones: below about 12 random characters, offline guessing becomes plausible.

Store it as carefully as you chose it

A strong encryption password only helps if you still have it when you need to decrypt. Save it in a reputable password manager, or write it down and keep the paper somewhere genuinely secure, such as with your important documents. If the tool offers a recovery key, record that too, and store it separately from the password. With SecretPNG, losing both the password and the recovery key means the data is permanently unrecoverable, by design.