That's a good one to be prepared for. I don't know what Dropbox's account recovery procedure is (which does have a support ticket system available), but if you

That's a good one to be prepared for. I don't know what Dropbox's account recovery procedure is (which does have a support ticket system available), but if you also back it up to Google Drive; you can recover the Google account by an automated phone call to a specified number. Accessible off-site backups are obviously good, but for various reasons it's unlikely everybody does this so I think the method above should be reasonable. If it's something as dire as a fire where all devices including the phone are lost (by the way, for Android I favour Keepass2Android which comes with Dropbox syncing & fingerprint reader support), you would probably need to get replacement identity documents as well as a new phone & SIM card for the same number (it's probably quicker in the meantime to have the Google Account Recovery robot call another number you've previously listed to reset a 2FA/password). Additionally, I don't think using a Diceware passphrase is a bad idea so long as it's never reused. After all, a solid passphrase is required for the password database, so learn two (or three - quick local system login might also handy). The process with real dice is quite fun to do and feels meaningful enough that it's adhered to and memorised. I think a combination of no more than a few Diceware passphrases combined with password manager-generated passwords for all other sites is a balanced option. For typed passphrases, I no longer use anything except Diceware - not only are they easier to remember and enter, they're also more "expendable" and don't require any particular attachments to be formed since the generation process is robust and unbiased (unlike "hashed" passages from books and song lyrics). For English-speakers, I recommend the EFF's list linked at http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html