Most passwords come with a safety net. Forget the one for your email account and you click a link, answer a question about your first car, and you are back in. A passphrase on an end-to-end encrypted calendar is a different kind of object. It is not a credential the service stores. It is the only copy of the key.
The passphrase is the key, not a way to ask for it
In an encrypted calendar, events, notes, calendar names, descriptions, colours and custom fields are encrypted on the device before they go anywhere. The key that does the encrypting is derived from your passphrase on that same device. The passphrase itself is never sent. What crosses the network is one half of what the derivation produces, and what the server keeps is a hash of that half — enough to confirm a sign-in, and useless for reading anything. The half that opens the calendar never leaves the device.
That is the whole point, and it is also the trap. If the operator could reset your passphrase, the operator would need a way to reach your key. A way to reach your key is a way to read your calendar. A reset button and end-to-end encryption pull in opposite directions, and you can only have one of them. CamyCal has no reset, which means a forgotten passphrase is not a support ticket.
What actually makes a good one
Length matters more than the mix of characters. Four or five unrelated words, strung together, is stronger than eight characters with a capital letter and a symbol, and it survives being said out loud to a partner over the phone.
The real constraint is retyping. This is a passphrase that gets typed on a phone, sometimes on a small screen with a keyboard that keeps capitalising the first letter. A phrase of ordinary lowercase words avoids a surprising amount of that friction. Do not reuse it from an email account, and do not use a slight variation on something you already have. If one account is breached, a variation hands over the rest.
Where a password manager helps, and where it stops
A manager is the right home for a long passphrase you never intend to memorise. It generates, stores and fills. It means one person in the household can hold something genuinely arbitrary without needing to recall it.
The limit is that the manager then becomes the thing that matters. It has its own passphrase, and that one does have to be memorised, because if it goes, everything behind it goes with it. A manager is a single point of failure with an excellent lock on it, which is fine as long as you know that is what you have built. There is a second limit, and for a family it is the larger one. A shared calendar is shared. The grandparent, the coach and the school office will not be using your manager. A manager solves the problem for one person; it does not solve it for a household.
Treat the recovery code as a physical object
There is a recovery code, which is a second way to unlock the same data. It is the thing standing between a forgotten passphrase and a permanent loss, which makes it the most important piece of paper in the setup.
Print it. Paper in a drawer survives a dropped phone, a wiped laptop and a failed drive in a way that a file stored on any of them does not. Put it somewhere a fire will not reach, which usually means a second address. Do not keep it in the same place as the passphrase, and do not photograph it and leave the photo on the phone that holds the calendar. Two copies of the same secret in one place are one copy.
Decide who holds it, before you need it
The decisions worth making at the start are small, boring and take ten minutes. Who holds the recovery code. Where the second copy lives. What happens if that person is travelling, unwell, or no longer part of the household.
Underneath all of it sits an honest trade. If the passphrase and the recovery code are both lost, the data is gone. Not locked, not recoverable by support, not recoverable by the person who runs the service: unreadable, permanently. That is the price of a calendar that nobody else can read, and for most families it is a price worth paying. It only works if it is a trade made out loud, once, at the beginning, rather than discovered later at the worst possible moment.