4. Basics: Picking a password

You need to know the methods that they use to break into your encrypted devices in order to be invulnerable.
There are four methods: Brute Force, Dictionary, Mixed and tricking you to give it up.

Be mindful I am not talking about keys yet, just passwords (I know that password is a kind of key, I mean in general sense).
First method: DICTIONARY

Over the years there have been database leaks from websites exposing logins and passwords. They collect the passwords from them and rank how frequently certain passwords were used and they run a script to check if your password was ever in a database leak and they start their list from most frequently used passwords!

Second part of the dictionary attack is the fact that they in fact just run dictionaries. Common words are not safe.

A way to counter it is to use a unique password! Password that you have never used anywhere else. One of the most common ways they make you conform to that rule when making accounts is "At least one upper case letter, at least one symbol" or something like it. Common words are not safe and they make you alter them with some uppercase or a symbol in order so that it is not present in any dictionary. That is the reason they say to use password "p@ssw0rd" instead of "password"! Many people use words from their language, english, names of celebrities, events, places or any existing real words and that makes it so much easier for them to find out the password.

So in short: unique password that you have never used, that you suspect nobody on earth ever used, and avoid real and common words from your language and english especially.

Dictionary is the first one they are gonna attempt because most database leaks over the history of humanity prove that top 10 most common password are able to get into 10% of all accounts. Imagine cracking 1/10 accounts in just 10 attempts. That is how effective it is, and they will try it first. Unique password at all cost or it becomes a matter of hours when they get into your drive! If your data survives this attack - you very likely are safe and the other methods are much less effective and they will almost certainly fail but still follow everything I list or do your own research if you don't trust my claims.
Second method: BRUTE FORCE

Brute force is an automatic script that tries all possible combinations until it finds a match. (It is the same in principle as mining crypto on a sidenote). This the second (or third) method they will use. They will use it to crack short passwords in particular. I would say that passwords under 9 or 10 characters ARE BOUND to get found out, and passwords under 14 characters are not all that safe.

These brute force scripts have two rules regarding the order of how they check combinations:
1. They start with shortest strings first (so they start with shortest character passwords first)
2. They use charsets that you could have used first (because they are not gonna check characters that are impossible to use in the decryption window, and they will first check standard/common charsets for your country first until they try using for example historical obsolete yuan dynasty hanzi mixed with tifinagh and sumer combos).

You can counter the shortest string rule by having a long password. Because as password linearly grows in length - computing power required to test all combinations grows exponentially.

In terms of defense againist common charsets - not much to do. (If you fear it - use a key so that it is so infinitely unlikely they ever open it that even if you said what letters, numbers and characters are used in it - they would still have it so long that they would not find it. Don't fear it when your password is long.)

The above solutions will make them burn so much electricity and waste so much time that they will give up. Though fear quantum brute force attacks when they unevitably start selling quantum computers, look for post quantum algorithms whenever possible. Though as of 2025 I would not fear the police use it especially outside of USA.

There is another defense but it is nowhere as reliable as a long password. It is to make your password iteration time set to some value like for example 100ms. This effectively refuses to check any of their input until they wait out that set timer between tries. There are methods to bypass that timer but it usually depends on the device and software (research it for your particular case and assess risk on your own). For that reason I will never recommend it unless your password is very long already. Do not bet your freedom on one point of failure! Have multiple layers stacked if one fails. Use this password cooldown mechanism but still get a long password anyway. Absolute minimum would be 17 characters. Recommended at least 22 in my view. But remember to use quantum algorithm whenever possible as quantum computers would quickly find your password even if 100 characters long!
Third method: MIXED

By which I mean that they will brute force all combos of random dictionary words and common symbols used.
T
his method will find password "cutelittlekittens123" faster than "gk^f';@r1-SFg" because the first one is more likely to be chosen by a human (and they hunt for passwords of humans, and you are a human), rather than robotic second password which is quite random and unexpected. I hope you know what I mean!

In order to counter it you should insert symbols in seemingly random places.

Also realize that they are aware of it too, and by random I mean quite random.

As an example mind that they will sooner find "p@ssw0rd" than "passwMrd" because the first is expected low effort alteration (a=@) while the second one is more unique and undexpected.
Fourth method: TRICKERY

By trickery I mean phishing, keyloggers, RATS, going through your notes and finding out that you wrote it down, they will go through all devices you own and try the same passwords, . They will watch you and wait when you slip up.

They will get you to reveal it to them (like upper limit jailtime threats, or intimidation during an interview).
They will get anyone from your environment to reveal it to them, so never share your password with anyone.

Be prepared for such dirty tricks because no matter how well prepared you are for the three methods above - the fourth will catch you with minimal effort on their part.

When you are in custody and the detectives ask you for the password - be happy. It means they cannot crack it and use that interview as their last resort. They will not unlock it unless you tell them the password. Remember that no proof means no sentence. Plead the fifth, refuse to talk without a lawyer, ignore them until they inevitably will have to dismiss your encrypted devices as evidence.
CONCLUSION:

If you apply all the above then no court will touch you.