diff --git a/frontend/src/views/OnboardingView.vue b/frontend/src/views/OnboardingView.vue
index 0f5fb88..43f7c44 100644
--- a/frontend/src/views/OnboardingView.vue
+++ b/frontend/src/views/OnboardingView.vue
@@ -130,9 +130,21 @@
             </label>
             <p class="muted">
               Open <a href="https://vault.bstein.dev" target="_blank" rel="noreferrer">Passwords</a> and set a strong master
-              password you won't forget. If you can't sign in yet, check your Atlas mailbox in
+              password you won't forget.
+              Your master password is the one password to rule all passwords: use a long passphrase (64+ characters is a good target), and never
+              write it down or share it with anyone.
+              If you lose it, Atlas can't recover your vault.
+              If you can't sign in yet, check your Atlas mailbox in
               <a href="https://cloud.bstein.dev" target="_blank" rel="noreferrer">Nextcloud Mail</a> for the invite link.
             </p>
+            <details class="howto">
+              <summary class="mono">Master password guidance</summary>
+              <ul class="muted howto-list">
+                <li>Prefer a multi-word passphrase over a single word.</li>
+                <li>Never store it in plaintext or share it with anyone.</li>
+                <li>If you forget it, Vaultwarden can’t decrypt your data.</li>
+              </ul>
+            </details>
           </li>
 
           <li class="check-item" :class="checkItemClass('vaultwarden_browser_extension')">
@@ -1069,6 +1081,26 @@ button.secondary {
   margin-top: 10px;
 }
 
+.howto {
+  margin-top: 10px;
+  border-radius: 12px;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  background: rgba(0, 0, 0, 0.16);
+  padding: 10px 12px;
+}
+
+.howto summary {
+  cursor: pointer;
+  color: var(--text-muted);
+}
+
+.howto-list {
+  margin: 10px 0 0;
+  padding-left: 18px;
+  display: grid;
+  gap: 6px;
+}
+
 @media (max-width: 560px) {
   .recovery-verify {
     flex-direction: column;