Is there a formal name for such a thing, so I know what to google? Is it possible to make them as secure as randomly generated passwords?

An illustrative example would be something like picking a random book and then picking the words inside it using some process that can be recreated to generate a passphrase.


1 Answer 1


What you're asking for is if we can describe for you a process that would allow you to generate a password such that you can later guess it without knowledge of its outcome. But the problem is you have to explain what would stop an attacker from carrying out the same recovery process to guess your password:

  • If the recovery process used only public information, the attacker would just be able to do it themselves;
  • So it has to use some secret information, but if that secret is as strong as a random password then that doesn't gain you anything;
  • And if the recovery secret is weak then the password it reconstructs cannot be strong, because guessing the recovery secret is sufficient to reconstruct the supposedly "strong" password.

The simplest practical solution I can think of to forgetting a strong password is fundamentally low-tech: write the random password down and store in in a location that physically secure and/or guarded by parties you trust. This is not at all a fanciful or hypothetical recommendation; for example, 1Password (who I'm in no way affiliated with) provide a printable PDF "Emergency Kit" for users who wish to write down their master password and put it for example in a bank safe deposit box.

I can think of a more complicated elaboration of this: using secret sharing to split the secret into multiple "shares" so that a minimum number of them need to be brought together, and distributing them to different parties and/or locations and so on. But in this case you'd still be relying on a mix of physical security and trust; it's just a more elaborate version of writing down the password.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.