# Should I use one master SSH key/master passphrase, or many?

Generally, using multiple master SSH keys or master passphrases partitions the `derivepassphrase` configuration into sets such that the compromise of one master SSH key/master passphrase compromises all passphrases within that set of configurations.

However, using multiple master SSH keys or master passphrases also means that multiple SSH keys or passphrases must be managed.

## Multiple master SSH keys

Managing multiple master SSH keys is conceptually no different than managing a single key.

`derivepassphrase vault` can record which master SSH key to use for each configuration.

## Multiple master passphrases

Managing multiple master passphrases is somewhat more difficult.
The user must choose multiple high-quality master passphrases.
If passphrases are memorized (as is recommended), then this puts a much higher cognitive load on the user than keeping multiple master SSH keys.

Furthermore, `derivepassphrase vault` cannot record which master passphrase to use for each configuration, beyond storing the respective master passphrase itself (which is a **grave security risk**).
The user must thus find a different (usually out-of-band) way to associate each configuration with its matching master passphrase.

Due to these logistical difficulties, from a purely operational standpoint, using multiple master passphrases **is not recommended**.