I use the old school method. Each password is a combination of my one preferred password, and three words that relate to the subject but are too funny to forget. For instant, Amazon would be “FuckJeffBezos123456Aa*” or something like that. I only have to remember my version of the “123456Aa*” because every time I think about amazon I already think “fuck Jeff Bezos”.

This uses your mind’s natural ability to associate instead of just raw memory. It also guarantees your passwords always meet requirements.

Lastly, record them all in the meat space in a small journal that I place in a conspicuous place. You can’t hack a notebook and I’m not important enough to rob for access to my Lemmy account.

I use a password manager so I don’t have to remember all of the hundreds of passwords that online services insist I set up. Each one is unique and complex, unguessable … and there’s no way I could remember them all. Before the password manager, I would find a good password and use it for many/most places, meaning that if anyone was careless and leaked my actual password, then someone would effectively have all my passwords.

But to answer your question, yes, for apples implementation, your normal account and phone unlocking also unlock your passwords. Depending on settings, you probably need to use your biometrics each time

My password manager password is about 50-70 characters long. It’s just a phrase that’s easy for me to remember which means nothing and then has some extra numbers and symbols to make it harder.

Password managers are best for accounts that can be accessed from anywhere.

For device specific passwords I do have those passwords stored in my vault but those are ones I remember because I need them to access the vault to prevent a chicken and egg problem.

You should not use lockscreen password as your master password. Chances are, your lockscreen password is much simpler than your master password. Reason why you can get away with it is because your mobile devices usually have some form of well-integrated isolated environment that can throttle brute force attacks. Your password managers probably cache your vault offline, which may be vulnerable to brute force attacks unless it utilises TPM in some way. Same goes for FDE. Online vaults probably have some sort of rate limiting so that isn’t much of an issue.

One thing I strongly recommend is being realistic with your goal. Current scheme seems a bit too paranoid.

Yes, you do still have to remember a handful of passwords, but remembering three or four is a much smaller burden than remembering upwards of 50 or 100. (This might seem excessive, but my password manager tells me I have at least that many.)

If that opens up brain space, make those three or four as long and complicated as possible.

String together things only you know and will always remember, but throw in a few random symbols to make the job harder if you accidentally let any of the regular facts and figures slip.

You might also be interested in something like https://www.passwordcard.org/.

Edit to be an unpaid shill for say I’m a happy user of Password Safe, too: https://www.pwsafe.org/

If you have your (encrypted) password manager file backed up to one or more otherwise unencrypted media, then remembering your master password will be enough in a pinch. But yes, for day to day password handling you’d want to have a few more memorized, e.g. the ones you’ve mentioned. As those are passwords you enter daily, it’s usually not much of a problem, especially if you use memorization techniques.

Phone is a 6 digit pin.

I find passphrases very easy to remember. I have different ones for my laptop, external hard drives, Proton, Tuta, and password manager.

I find it helpful to make the passphrase an insult toward a company or group such as “go away piggy this is mine”.