I am a big fan of 1Password. And I try to save my passwords in 1Password as much as possible.

However, there are environments where 1Password cannot be used. That is the password to protect 1Password itself and the password for full disk encryption before the OS boots.

I have a laptop that I use daily and a server at home. And both of them are encrypted with LUKS.

And I am a journalist in a repressive country. My computers can be seized by the state.

Now, the main question. Should the full-disk encryption password for my laptop, which shuts down frequently, be different from the full-disk encryption password for the server, which is always running, and the 1Password password? Or would the same password be acceptable?

If they should be different, how do I remember a long password? I can remember one, but it is extremely difficult to remember more than one.

  • Pass phrases are easier to remember than passwords. The Hotel down by the Sea is a better password than THdbt5. The downside is it takes longer to type. Oct 27, 2022 at 12:02
  • If you use your passphrases frequently and regularly, you should end up remembering them without too much effort. Also, poems use rhymes and rhythm to make them easier to remember: you can do the same in your passphrases.
    – A. Hersean
    Oct 27, 2022 at 16:03
  • Sorry if this is a dumb question, but couldn't you store it in 1password on your phone, then open up your phone, view it, and type where you need it?
    – John Wu
    Oct 27, 2022 at 22:27

2 Answers 2


IMHO, strong passwords are good to protect things (data, operating systems, etc.) against distant attacks. When it comes to the real world and when attackers could use physical threats (this may include special police in repressive countries) what matters is plausible denialability, if non detection is not possible. Even if I know that a password is strong enough against brute force attacks and hard to guess, I could just have to give it if an attacker was to threaten my life or the life of members of my family.

That being said, several words pass phrases are no so hard to remember. Slightly modified song or poems texts (portions of them...) can be both easy to remember and strong enough for most concerns.

The only rule should to not use the same password for security zones of very different levels. If you need a password to unlock your smartphone to show a photo to a friend, you might not control that nobody is looking over your shoulder, as much as when you type one to access a highly sensitive database...

  • what matters is plausible denialability - that works in court, but not against physical threats. If I suspect that the random data is encrypted and you know the key, I'll torture you. If you don't know the key or it's actually just random data, bad luck, but no cost incurred...
    – Haukinger
    Oct 28, 2022 at 10:14
  • @Haukinger: I was thinking about VeraCrypt hidden volumes. That way I can give you the key for the normal volume still hiding the other one. But as it is discussed in VeraCrypt doc, having the hidden volume non detectable actually requires to be very cautious... Oct 28, 2022 at 13:07
  • The problem with this is that you can never prove that there's no more hidden volume in the last one you revealed. A determined interrogator thus has no reason to stop interrogating.
    – Haukinger
    Oct 28, 2022 at 17:10

As others have already mentioned, if you are arrested and be forced to give the keys then it does not really matter what kind of keys or how many of them you use; you'll have to give them away anyway. So you may want to think of other approaches in order to protect you/your work (e.g. steganography or having your server in another country, away from your country's jurisdiction, to which you connect from your laptop, in which laptop you store nothing).

Now, to the point of your question, the short answer is yes, they should all be different.

The reason is that a single password can grant access to all of your protected data (server, laptop, 1Password) if it gets compromised. For example, a knowledgeable adversary could just target your server from the internet, exploit the software on it, gain admin level access, extract the key (e.g. from memory or by installing a bootkit), then visit your home while you're out, copy your laptop's hard disk without leaving any trace and then use the password to decrypt your laptop's copied disk. And you wouldn't even know. Which also means that they could do it again and again, getting access to any new info you put in your computer. (I guess I don't have to explain the impact this will have, if the same password is the master password for 1Password).

On the difficulty of remembering a long password, that's easy: use a passphrase. An easy way to find one is to pick a song that you remember well, get one sentence from the song, change some letters to their optical similar numbers (e.g. o to 0, A to 4 etc), capitalize a couple of the letters and you have a pretty strong passphrase. For the next system you may use the next sentence of the song or a sentence from another song.

Whatever you do, though, I would suggest that you coin a method about how you derive such passphrases, so that your passphrases are consistent and make sense to you and you don't get locked out of your data eventually.

  • change some letters to their optical similar numbers (e.g. o to 0, A to 4 etc), If you do that, I will not be able to remember my passphrase.
    – user284652
    Oct 29, 2022 at 15:29
  • If you do this systematically, in a way that makes sense to you then you will be able to remember it. For example, if you take the phrase "we are the youth of the nation" and you decide that you'll substitute each "e" with "3" and "o" with "0" for every passphrase you use, then you'll end up with "w3 ar3 th3 y0uth 0f th3 nati0n" (spaces added for clarity). The complexity of the passphrase has increased significantly. Does it make sense?
    – user284677
    Oct 29, 2022 at 15:38

You must log in to answer this question.