LEARN · PRACTISE · DISCOVER
Strong Passwords and Account Security
Your accounts hold messages, photos, schoolwork and sometimes payment details. If someone breaks into an account, they could read your messages, pretend to be you or lock you out. Your password is the main lock on the door. In this lesson you will learn how to create strong passwords and add extra layers of protection.
What makes a password weak?
Attackers use computer programs that can try enormous numbers of guesses very quickly. They also use lists of the most common passwords and details found online about you.
| Weak password | Why it is weak |
|---|---|
| 123456 or password | among the most common passwords in the world |
| your name or pet’s name | easy to find on social media |
| your birthday | often visible online |
| football1 | a common word plus a number |
| the same password everywhere | if one site is breached, all your accounts are at risk |
Creating a strong passphrase
Length is one of the most important parts of a strong password. A good method is to create a passphrase from several random words.
The random words method
- Pick three or four random, unrelated words: river, pancake, violin, cloud.
- Combine them: RiverPancakeViolinCloud.
- If the site requires it, add a number or symbol: RiverPancake7ViolinCloud!
This passphrase is long, hard to guess and much easier to remember than a jumble like x7$Kq2.
Avoid predictable phrases
Do not use famous quotes, song lyrics or sports team names. Choose words that have no obvious connection to you or to each other.
One account, one password
Use a different password for every important account. Many data breaches happen at large companies, not because users made mistakes. If you reuse a password and one website is breached, attackers may try that password on your email, games and social media.
Password managers
A password manager is an app that securely stores your passwords so you only need to remember one strong master password. Many browsers and phones include one. Ask a parent or carer to help you set one up.
Two-step verification
Two-step verification, also called two-factor authentication or 2FA, adds a second lock. After entering your password, you also need a code from your phone, an authenticator app or a security key. Even if someone steals your password, they still cannot get in without the second step.
Example
Lena received an email saying someone had tried to log in to her account from another country. Because she had turned on two-step verification, the attacker could not get in without her code. She changed her password straight away and told her parents.
Keeping passwords secret
- Never share passwords with friends, even best friends. Friendships can change.
- Only share them with a parent or carer if your family agrees.
- Log out on shared or school computers.
- Never type your password into a page you reached from a suspicious link.
- Lock your phone and devices with a PIN, pattern or fingerprint.
If an account is hacked
Act quickly: change your password, turn on two-step verification, check your account recovery email and phone number, tell your friends not to trust strange messages from your account, report it to the service and tell a trusted adult.
Key takeaways
- Weak passwords are short, common or based on personal details.
- Use long passphrases made of random words.
- Use a different password for each important account; a password manager helps.
- Turn on two-step verification and never share passwords with friends.
Practice
1. Rank from weakest to strongest: Max2012, qwerty, LanternGiraffeOrbitTulip. 2. Explain in one sentence why two-step verification helps.
Answers: 1 qwerty (weakest), then Max2012, then LanternGiraffeOrbitTulip (strongest). 2 even if someone steals your password, they still need a second code or device to log in.