Internet & Identity · lesson 9 of 17 · 15 min
Why passwords must stay private
Your password is like the key to your house. If you hand that key to someone, they can walk in whenever they want — even when you are not home and even when you do not want them there. The same is true for your digital accounts. If someone else knows your password, they can log in as you, read your messages, change your settings, and even pretend to be you.
This is why keeping your password private is one of the most important rules in cybersecurity. It is not about distrust — it is about protection. Even people who care about you can accidentally cause problems if they know your password.
Think about what happens if you share your password with a friend. Your friend might tell another friend. That friend might tell someone else. Before long, people you do not even know could have access to your account. And once a password is shared, you cannot un-share it — you can only change it.
The golden rule: Your password should be known by exactly one person — you. The only exception is sharing with a parent or guardian when they need to help you with your account.
What can happen if someone gets your password?
When someone else has your password, they have full access to everything in that account. Here are some of the things that could go wrong:
Impersonation They could send messages pretending to be you, which could hurt your friendships or reputation. Deletion They could delete your saved games, schoolwork, or important files. Lockout They could change your password, locking you out of your own account. Private info theft They could read your private messages and learn personal information about you. Purchases If the account is linked to payment info, they could make purchases. Embarrassment They could post embarrassing things in your name that you cannot take back.
Password privacy rules
Here are the most important rules for keeping your passwords private:
- Never tell your password to friends — even your best friend. Friendships change, and they might accidentally share it.
- Never type your password where others can see — be aware of people looking over your shoulder (called “shoulder surfing”).
- Never send your password in a message — not in a text, email, or chat. Legitimate websites will never ask for your password this way.
- Change your password immediately if you think someone else knows it.
- Use different passwords for different accounts — so that if one is compromised, the others stay safe. Shoulder surfing: This is when someone watches you type your password by looking over your shoulder. Always shield your screen when entering a password in public — at school, the library, or anywhere others might see.
Key words to remember
- Password privacy
- Shoulder surfing
- Impersonation
- Account compromise
- Password change
Match each password privacy concept to its meaning
Why passwords should be private — quiz
Your best friend asks for your password to help you log in. What should you do?
- Give it — they’re your best friend
- Ask a trusted adult to help instead
- Write it on paper for them
- Tell everyone your password
Answer: Ask a trusted adult to help instead
Even with best friends, passwords should stay private. Ask a trusted adult to help instead.
Who is it okay to share your password with?
- Your classmates
- Anyone who asks
- A parent or guardian who needs to help you
- Your online friends
Answer: A parent or guardian who needs to help you
Only share your password with a parent or guardian when they need to help you with your account.
If someone knows your password, they can log in as you and pretend to be you.
- True
- False
Answer: True
With your password, someone can access your account and do anything you can do — including sending messages as you.
What is shoulder surfing?
- A type of surfing sport
- Watching someone type their password by looking over their shoulder
- Sharing your password with a friend
- A type of computer virus
Answer: Watching someone type their password by looking over their shoulder
Shoulder surfing is when someone watches you enter your password. Always shield your screen in public.
What should you do if you think someone else knows your password?
- Do nothing — they probably will not use it
- Change your password immediately
- Tell all your friends
- Delete your account
Answer: Change your password immediately
If someone else knows your password, change it right away to protect your account.
It is safe to send your password in a text message to a friend.
- True
- False
Answer: False
Never send your password in a message. Text messages can be read by others, and legitimate services will never ask for your password this way.
Why should you use different passwords for different accounts?
- To make it harder to remember
- So that if one account is hacked, the others stay safe
- Because websites require it
- To confuse hackers
Answer: So that if one account is hacked, the others stay safe
Using unique passwords for each account means a hacker who gets one password cannot access all your other accounts.
What could happen if someone gets your password?
- Nothing bad
- They could impersonate you, delete your files, or lock you out
- They could only read your messages
- They could only see your username
Answer: They could impersonate you, delete your files, or lock you out
With your password, someone has full access to your account — they can do anything you can do, including locking you out.
A website sends you an email asking for your password. What should you do?
- Reply with your password
- Ignore it and tell a trusted adult — legitimate sites never ask for your password
- Give a fake password
- Change your password to the one they suggest
Answer: Ignore it and tell a trusted adult — legitimate sites never ask for your password
Legitimate websites never ask for your password via email. This is likely a phishing attempt.
Sharing your password with a friend is safe because you trust them.
- True
- False
Answer: False
Even trusted friends can accidentally share your password or their account could be compromised. Passwords should stay private.
Previous lesson: Strong vs. weak passwords
Back to Internet & Identity
Next lesson: What is an account?