A memorable sentence is not automatically strong

Length helps only when a secret is difficult to predict. A personal story, familiar quotation or sentence about your family does not have a measurable strength simply because it contains many words. An attacker may try predictable language and information about you. Adding a date or punctuation does not turn a predictable sentence into a random secret.

Prefer a long, unique, randomly generated password from a reputable password manager or the generated ZeroLatch recovery phrase. CISA’s password guidance emphasises long, random and unique passwords. Do not copy a password example from an article.

Understand what the Private secret unlocks

A Private delivery password or ZeroLatch recovery phrase unlocks that delivery. It is not your cryptocurrency wallet seed and should not be substituted for one. Keep wallet recovery procedures separate and use the wallet manufacturer’s current instructions. Never enter wallet seed words into a public draft or a general support form.

Private uses cryptographic key derivation to turn the chosen secret into key material. This can increase the cost of guessing, but it cannot make a predictable password equivalent to a uniformly random secret. Do not attach an invented entropy estimate or an “impossible to crack” claim to a sentence you made up.

Plan for recovery without relying on memory

Store the Private secret securely and agree how your recipient can obtain it separately when needed. Do not put the only copy inside the delivery it unlocks. Consider what happens if your password manager, device or usual contact becomes unavailable, and make the fallback understandable to the person who will use it.

ZeroLatch cannot reset a lost Private secret. If maintaining a separate secret is unsuitable, review Simple access and its service-managed recovery trade-off on the security page. Choosing the simpler workflow changes key custody; it does not remove the need for an independent backup.

Test the instructions with harmless material

Begin with the fictional recipient example. For a real rehearsal, use non-sensitive content and an informed recipient, and agree the setup with support. Do not shorten a live account schedule casually: it affects active deliveries that share that schedule.

Separately check that the recipient can locate and open your independent backup. Record the test date in your own records, then repeat after changing the secret, recipient or device. The backup checklist helps organise these steps without asking you to enter secrets into it.