What is a Double-Blind Password

Why Trust Tech Report

Tech Report is one of the oldest hardware, news, and tech review sites on the internet. We write helpful technology guides, unbiased product reviews, and report on the latest tech and crypto news. We maintain editorial independence and consider content quality and factual accuracy to be non-negotiable.

Ever wonder just how secure your passwords really are—especially if you use the same password for all your accounts (a terrible idea, by the way)? A double-blind password could put your mind at ease.

So read on because this article will explain exactly what a double-blind password is, how it can help protect your accounts, and how to set one up.

Most importantly, though, we’ll cover how a double-blind password can protect your online accounts from hackers. Because, like it or not, the bad guys are out there. We’ll touch on more of the scary stuff later.

What Is A Double Blind Password Exactly?

A double-blind password is essentially a unique password that is never stored anywhere. That last part is important — because it’s not stored anywhere, it can’t be stolen.

One part of a double-blind password is generated by and stored in a password manager. The other part is a unique identifier (ID), a short and easy-to-remember ID that only you know and that the password manager cannot see.

So, essentially the password is split into two, a password that is (mostly) invisible to the user and a unique ID that is invisible to the password manager.

By the way, double-blind passwords go by other names. Horcruxing is one of them, and yes, it’s a Harry Potter reference. A Horcrux is an object in which a dark wizard (hello, Lord Voldemort), searching for immortality, hides a fragment of their soul. Other terms include pepper, splitting, and partial passwords.

How Does A Double-Blind Password Work?

You may now be wondering how a double-blind password works and where you would use one.

Using a double-blind password makes a hacker’s job harder—much harder. So, if you have more than a few online accounts, it is worthwhile setting up a double-blind password for added protection.

Say you use a password manager, and, for example, your Instagram account’s password is stored in its vault. Then along comes a nefarious hacker who breaches your password manager (unlikely, but never say never). The hacker would then be able to find your Instagram password in the vault and access your account.

However, if your Instagram account has a double-blind password, then the password the hacker found in your vault is useless to them, and your Instagram account will be safe. That’s because the hacker doesn’t know your unique ID.

Your double blind password will have protected your Instagram account from being hacked while ruining the hacker’s time and, hopefully, his day, too. High five.

The time it takes to crack MD5 hash passwords

What Are The Benefits Of Using A Double Blind Password?

Why consider adopting a double-blind password strategy? The biggest benefit is heightened security, which is important considering the cyber crime stats.

According to a 2023 Norton report, hackers exposed more than 24 billion passwords in 2022 alone, and at least 80% of confirmed breaches were related to stolen, weak, or reused passwords.

Here’s what else Norton had to say:

A common mistake people make is choosing a simple password, but the more complicated it is, the more secure it will be.

Password entropy, which measures a password’s strength, has a big influence on its effectiveness against hackers. We know hackers love weak passwords, especially when the same one is used across multiple accounts.

If you don’t have a password manager and are wondering how strong your passwords really are, 1Password has a tool that can show you.

A password manager, such as the excellent NordPass, can significantly improve the security of your password. That said, they’re not completely immune to security breaches. Just ask NortonLifeLock and LastPass; they were hacked in 2023.

Now, imagine a hacker got their hands on the master password to your password manager. That would mean they’d have full access to all the accounts with passwords stored in its vault. That’s where using double-blind passwords can save the day, giving the security of your accounts an added punch that turns them into a virtual Chuck Norris.

Another benefit of using a double-blind password strategy is that it is easy to remember. The average number of account passwords per internet user varies, depending on who you ask, but the general consensus is that it ranges from around 35 to more than 100. Even at the lowest end of the spectrum, 35 passwords are a lot to remember. That’s where a password manager comes in useful.

A password manager can encrypt and store the passwords you use on your accounts. Your section of the double-blind password (sometimes referred to as the ‘pepper’) should be easy to remember — short and simple, and the same for each account.

Here is an example:

A double-blind password is a great way to secure any type of account, such as email, online banking, social media, software, and so on.

It’s particularly useful if you have a business that handles sensitive material. Medical practices, financial institutions, government departments, and so on need to protect their data at all times, even from insider threats. After all, cybercrime is at an all-time high and set to get worse.

Do You Need A Password Manager For A Double-Blind Password?

If you don’t have a password manager, can you still set up and use double-blind passwords? No, you cannot. There’s no such thing as a double-blind password manager.

Remember, the password manager creates, encrypts, and then stores a password in its vault, hauling it out when you want to log into an account.

You don’t need a password manager to create, save, and use a password. But it doesn’t have ‘pepper’. It’s not split into double aspects, and it’s not blind. It’s simply a password.

That’s not to say a simple, non-double-blind password is defenseless. Again, this is where password entropy is important. The more complicated and less obvious a password is, the stronger and more resilient it will be to a security breach.

What Are The Key Features of Password Managers?

Password managers are powerful tools that tighten security while also adding convenience. Here are some of the key features you can expect from a password manager.

Password Generator

All of the best password managers, such as NordPass, 1Password, and Dashlane, have password generators that create secure passwords for your accounts.

A password generator will give you options when generating a password:

Once you’ve selected your preferred options, the password can be copied and/or saved.

Two-factor Authentication

Password generators also offer a two- or multi-factor authentication (MFA) option. Once enabled, this added layer of security means additional authentication steps—such as an authenticator app, a USB key such as YubiKey, or biometrics—will be needed when accessing an account, over and above a username and password.

Unlimited Password storage

NordPass, like most password managers, has unlimited password storage. So whether you have 10 online accounts or hundreds, the sky’s the limit.

Autofill and Autosave

Autofill is a super-convenient feature that allows you to enter your credentials in online forms instead of having to fill them out yourself. You choose which details it enters.

The Autosave and Autofill features save your details when logging onto a new account and offer to fill them out for you when you next access that website. It works across all browsers — Chrome, Firefox, Edge, Brave, and mobile devices.

Store Card Details

Are you an avid online shopper? A password manager can store your credit card details to make the check-out process faster and more convenient. It can also autofill your shipping and billing information.

Password Sharing

Password sharing is a way of sending your credentials to someone else—be it a family member or colleague—without the risk of them being intercepted. It does this by encrypting the data and placing it in their password manager vault.

NordPass, for example, offers two ways of doing this: via the app or with NordApp’s free Password Sharer tool.

Multi-device Support

Few people have just one device, so how do you get your password manager to ‘talk’ to your computer, tablet, and phone?

Most password managers can automatically sync your passwords across multiple devices, and many are available across all operating systems, including Windows, macOS, Linux, Android, and iOS.

Biometrics

Biometric authentication, be it fingerprints or voice, has become a trusted security measure across many industries. NordPass, like other password managers, has a biometric authentication — Passkeys.

This feature enables you to log into your accounts using your face, fingerprint, or a screen unlock pattern instead of a password. It works on computers, too; all you need is a fingerprint reader.

Email Masking

What is email masking, you might ask? Generated by the password manager, it’s an alternative email address linked to your main email account. The email mask redirects all incoming messages to your primary email without revealing its actual address.

NordPass recently added this option to their app, and it’s a really handy feature.

The mask is a randomly generated email that hides your identity online. Concealing your primary email address reduces spam from sign-ups, trials, and promotional emails.

It also helps prevent your primary email address from being collected and used for ad targeting and data mining. Who wouldn’t like that?

Password Health

Are you curious about the strength of your (perhaps many) passwords? The NordPass Password Health feature gives you a comprehensive diagnosis of any weak, reused, or old passwords you are using.

Data Breach Scanner

How will you know if any email or store card details have been compromised? The Data Breach Scanner monitors both. It can monitor multiple email addresses and cards and will notify you every time a breach occurs.

Emergency Access

NordPass Emergency access lets you give access to another NordPass user, who can then request access to your account without entering your Master Password. This feature is available on desktop, android apps and Web Vault.

Notes

Love those Post-Its but drowning in a flurry of colorful stickies? Important information deserves better than that, especially when that data is sensitive. Think 2FA recovery codes, financial data, your WiFi password or house alarm code, software keys, and even business ideas, and travel details.

Those notes are stored in the same vault as your passwords, which means they are encrypted and secured by the same high-level security.

How Do You Add Double-Blind Passwords To Your Password Manager?

How exactly do you add a double-blind password to your password manager? You don’t.

Remember, you’re adding a unique ID to the encrypted password generated by your password manager, whether it’s on your computer, tablet, iPhone, or Android device. Sharing that unique ID with your password manager defeats the purpose of a double-blind password—it’s no longer double or blind.

Instead, use your password manager to generate strong, encrypted passwords for your accounts, and then add a unique ID to each account separately.

For this step-by-step guide to show you how to create a double-blind password, we’re using NordPass, although there are lots of other good password managers on the market. Take a look at some of the other top password managers we’ve already reviewed.

Start by going to the account — Facebook, for instance — that you want to create a double-blind password for and head to the Change Password page.

In the New Password field, click on the NordPass icon.

It will generate a password based on the options we mentioned earlier — type, length, composition, and so on. When you’re done, select Fill Password.

NordPass will then prompt you to update that password. This bit is important. Say yes to NordPass before you save the password on Facebook. NordPass will send that password straight into the safe and warm arms of the password manager vault.

Now it’s time to add your unique ID. At the end of the new password, add something short and easy to remember. For this example, we’re using Duck as the unique ID.

Add the same unique ID to the Confirm New Password field to ensure they match and hit Change Password.

The account will now be accessible with the new password, which comprises the encrypted password courtesy of NordPass and your unique ID.

And just like that, a double blind password is born.

The next time you log onto your account and need to enter a password, NordPass will offer to autofill your username and password. Let it, but remember, it’s adding only the part of the password it knows.

You need to manually add your unique ID at the end of the password before hitting Log In.

The beauty of a unique ID is that you can create double-blind passwords across the board with the same one. You can use the same unique ID for absolutely every account you have, including Facebook Duck, the online banking app Duck, your email account Duck, and Instagram Duck.

However, there is a drawback to using a double-blind password. Every time you add your unique ID to the password on a login page, the password manager will ask if you want to update that password with the unique ID.

You won’t want to do this because saving it as an ‘updated’ password means it is no longer double-blind.

NordPass doesn’t seem to have a workaround for this, and that’s pretty annoying. But there are other password managers that do.

Some have an option to make autosave exceptions for certain domains. Add the sites you don’t want the password manager to automatically offer to save new passwords for. It’s as simple as that.

Final Thoughts

Chances are you’re thinking, ‘Well, that’s nice and all, but do I really need double-blind passwords for all my accounts?’

If you’re concerned about the privacy of your data, a good password manager is your first line of protection (alongside top antivirus software, of course).

Harder-to-hack passwords immediately up the defense ante, especially if you tend to use easy-to-remember passwords, like ones that combine your mum’s birthday and pet’s name, or (cue gasp) if you use the same password for all your accounts.

A password manager is simply good online hygiene. It does the tough stuff for you; it creates and remembers difficult passwords, saves time completing online forms, and locks your details in a digital version of Fort Knox.

Are password managers completely foolproof? They’re generally extremely secure and resilient to breaches, but they aren’t always impenetrable. So, using a double-blind password is an extra layer of security to protect your accounts and give hackers a headache.

The concept is simple. The password manager provides an encrypted password that you don’t need to remember and stores it in its vault. Then you ‘pepper’ the password with a unique ID.

You’re blind to the encrypted portion your password manager conjures up, and your password manager (and potential hacker) is blind to your unique ID. Double-blind, double protection.

The only two downsides — remembering to add the unique ID to the password manager’s autofill each time you log in, and if your password manager doesn’t have the option to exempt certain sites from its autosave.

Ultimately, it’s about safety first. A double blind password adds an extra layer of protection that could prevent a data breach. What’s not to like about that?

FAQs