Cybersecurity Foundations (Grades 6–8) · lesson 4 of 48 · 25 min
The Password Problem
Passwords are the most common way we prove who we are online. Every account you have — email, gaming, school, social media — is protected by one. And yet, year after year, the most common passwords in the world are still “123456”, “password”, and “qwerty”. These can be cracked in under one millisecond.
Why does this matter? Because your accounts contain your personal messages, your school records, your photos, and sometimes access to your family’s financial information. A compromised account is not just embarrassing — it can cause real, lasting harm.
In this lesson you will learn exactly how attackers crack passwords, what makes a password genuinely strong, why uniqueness matters as much as strength, and how password managers solve the problem of remembering dozens of strong passwords.
The scale of the problem
The website HaveIBeenPwned.com tracks data breaches. As of 2026, it has catalogued over 14 billion compromised accounts. That means billions of real username and password combinations are freely available to attackers right now. If you reuse a password from even one old account, attackers may already have it.
How Attackers Actually Crack Passwords
Before you can build strong passwords, you need to understand what you are defending against. Attackers use several techniques, and knowing them changes how you think about password design.
The most important insight from this table: length defeats brute force, uniqueness defeats credential stuffing, and awareness defeats phishing. No single technique protects against everything — you need all three.
Here is the maths on length. A password using only lowercase letters has 26 possible characters per position. A 6-character password has 26⁶ = 308 million combinations. A modern computer can try 10 billion combinations per second — that is cracked in 0.03 seconds. Add uppercase, numbers, and symbols (95 characters), and a 6-character password has 95⁶ = 735 billion combinations — cracked in about 73 seconds. But a 16-character password with the same character set has 95¹⁶ = a number with 31 digits. At 10 billion attempts per second, that takes longer than the age of the universe.
The substitution myth
Replacing letters with numbers — “p@ssw0rd”, “h4ck3r”, “s3cur1ty” — does not make passwords significantly stronger. Attackers’ dictionaries include all common substitutions. “P@ssw0rd” is cracked in minutes. The only thing that genuinely increases strength is length and true randomness.
Activity 1 — Rate the Password
Sort each password into the correct strength category based on what you just learned. Think about length, predictability, and whether it uses real words or personal information.
Password Strength Sorter
- password123
- weak
One of the most common passwords in the world. In every dictionary attack list. Tr0ub4dor! medium 10 characters with substitutions — better than most, but substitutions are known. Crackable in hours.
- correct-horse-battery-staple
- strong
28 characters of random words. Length alone makes this extremely strong.
- MyDog2015
- weak
Personal information (pet name + year) — easy to guess from social media research. xK#9mP2$vL7@nQ4! strong 16 random characters with full character set — billions of years to brute force.
- qwerty
- weak
Keyboard pattern — second most common password globally. Cracked instantly.
- Sunshine!99
- medium
Common word + symbol + number. Better than “sunshine” but still in augmented dictionaries.
- purple-lamp-river-seven-cloud
- strong
5 random words — 30+ characters. Extremely strong and actually memorable.
The Uniqueness Rule — Why One Breach Can Destroy Everything
Even a perfectly strong password becomes dangerous if you use it on more than one site. Here is why.
Imagine you use the same strong password for your email, your gaming account, and your school portal. A small gaming site you signed up for three years ago gets breached — their database is stolen and posted online. Attackers now have your email address and that password. They immediately try it on Gmail, Outlook, school portals, banking sites, and hundreds of other services. This is called credential stuffing, and it is fully automated.
In 2019, a credential stuffing attack against Disney+ used leaked credentials from other sites to compromise hundreds of thousands of accounts within hours of Disney+’s launch. The users had not been hacked — Disney+ had not been breached. The problem was password reuse from old breaches.
The solution: one password per account
Every account needs its own unique password. This sounds impossible to manage — and it is, if you try to memorise them all. That is exactly what password managers are for. A password manager generates, stores, and fills in strong unique passwords for every site. You only need to remember one master password. This is not optional for anyone who takes security seriously — it is the standard practice.
When choosing a password manager, the most important features are: end-to-end encryption (your passwords are encrypted before they leave your device), a strong master password, and MFA on the manager itself. Even if the password manager company is breached, encrypted vaults are useless to attackers without your master password.
Activity 2 — Match the Attack to the Defence
Each attack method on the left has a specific defence. Match them correctly.
Attack vs. Defence Matching
Building a Passphrase — The Best of Both Worlds
The hardest part of strong passwords is memorising them. A passphrase solves this by using length instead of complexity. A passphrase is a sequence of random, unrelated words — long enough to be uncrackable, but memorable because it forms a mental image.
The key word is random. “I love my dog” is not a good passphrase — it is predictable and short. “correct horse battery staple” (from the famous XKCD comic) is strong because the words are genuinely random and unrelated. The best way to generate a passphrase is to use a method called Diceware — rolling dice to pick words from a numbered list, removing all human bias from the selection.
Entropy — the measure of randomness
Entropy measures how unpredictable a password is, in bits. Each bit of entropy doubles the number of guesses needed. A 4-word Diceware passphrase has about 51 bits of entropy — that is 2²¹ = 2 quadrillion possible combinations. At 10 billion guesses per second, that takes 2.3 million years to brute force. A 6-word passphrase has 77 bits — effectively uncrackable with any foreseeable technology.
Activity 3 — Password Scenario Decisions
Work through these real-world password situations and choose the best response.
Password Decision Scenarios
Activity 4 — Flashcard Vocabulary Review
Lock in the key terms from this lesson before the final quiz.
Password Security — Key Terms
Brute Force Attack An attack that tries every possible password combination systematically. Defeated by length — each additional character multiplies the search space exponentially.
- Attack
- Dictionary Attack
An attack using a pre-built list of common words, phrases, and known passwords. Defeated by avoiding real words and predictable substitutions.
- Attack
- Credential Stuffing
Using leaked username/password pairs from one breach to automatically try logging into other sites. Defeated entirely by using a unique password for every account.
- Attack
- Password Spraying
Trying a small number of very common passwords against a large number of accounts. Avoids account lockouts by not trying many passwords on one account.
- Attack
- Passphrase
A password made of multiple random, unrelated words. Long enough to be uncrackable by brute force, but memorable because it forms a mental image. Example: “velvet-trombone-glacier-eleven”.
- Defence
- Password Manager
Software that generates, stores, and fills in strong unique passwords for every site. You remember one master password; the manager handles the rest. Examples: Bitwarden, 1Password.
- Defence
- Entropy
A measure of how unpredictable a password is, in bits. Higher entropy = more possible combinations = harder to crack. Each bit of entropy doubles the guessing difficulty.
- Concept
- Password Reuse
Using the same password on multiple sites. Extremely dangerous — one breach exposes all accounts using that password to credential stuffing attacks.
- Risk
- Diceware
A method for generating random passphrases by rolling dice to select words from a numbered list. Removes human bias from password selection, producing genuinely random passphrases.
- Defence
- Master Password
The single password used to unlock a password manager. Must be very strong and memorised — it protects all other passwords. Should never be stored digitally or reused anywhere. Concept
Final Analysis — The Password Audit
Password Security Audit: Riverside Middle School
Password Audit — Riverside Middle School IT Review The IT team at Riverside Middle School is conducting a security audit after three student accounts were compromised in one week. Investigation revealed all three students were using the same password across multiple sites, and that password appeared in a 2023 data breach from a gaming platform. The IT team wants to understand what went wrong and what policies to implement. All three compromised accounts used the password “Gamer2023!” on both the gaming site and their school email The gaming site breach occurred in March 2023 — the school accounts were compromised 3 years later via automated credential stuffing None of the three students had MFA enabled on their school email The school’s password policy only required 8 characters and one number — no uniqueness requirement Two of the three students had never heard of a password manager
What attack technique was used to compromise the school accounts?
- Brute force attack on the school server
- Credential stuffing using leaked gaming site passwords
- Phishing emails sent to students
- A keylogger installed on school computers
Answer: Credential stuffing using leaked gaming site passwords
The attackers used username/password pairs leaked from the gaming site breach and automatically tested them against the school email system. This is credential stuffing — it works because the students reused their passwords.
What single habit change would have completely prevented these compromises?
- Using a longer version of the same password
- Using a unique password for the school email that was never used anywhere else
- Changing passwords more frequently
- Using a more complex password with more symbols
Answer: Using a unique password for the school email that was never used anywhere else
Credential stuffing only works when the same password is reused. A unique password for the school email — regardless of its complexity — would have meant the gaming site breach had zero impact on the school accounts.
The school’s password policy requires 8 characters and one number. What is the most important improvement to add?
- Require at least one symbol
- Require passwords to be unique and not reused from other sites
- Require passwords to be changed every 30 days
- Require passwords to contain the student’s name
Answer: Require passwords to be unique and not reused from other sites
Complexity requirements (symbols, mixed case) provide marginal benefit. The biggest risk here was reuse — a uniqueness requirement, enforced through education and password manager adoption, addresses the actual attack vector.
What additional control would have stopped the attack even if the password was reused?
- A stronger firewall
- Multi-factor authentication on school email accounts
- Longer passwords
- Blocking access from gaming sites
Answer: Multi-factor authentication on school email accounts
Even with the correct password, MFA would have required the attacker to also have the student’s phone or authenticator app. Without that second factor, the stolen password alone is not enough to log in.
Activity 2 — Password Manager Scenarios
Password managers solve the impossible problem of remembering dozens of unique, strong passwords. But many people have misconceptions about them. Work through these real-world scenarios and decide what the right action is.
Password Manager Decision Scenarios
Activity 3 — Attack Method Matching
You have learned seven password attack methods. Match each attack description to its correct name. This knowledge helps you understand exactly which defence stops which attack.
Password Attack Methods
Activity 4 — Build a Strong Password System
Understanding password security is one thing — applying it is another. Answer these questions to build your personal password security plan. There are no trick questions; the goal is to think through the real decisions you need to make.
Your Password Security Plan
You need to create a new password for your school email. Which of these is the best choice?
- Sch00l2026! (your school + year with substitutions)
- correct-lamp-seven-river (four random words)
- The same strong password you use for gaming
- Your name + birthday in reverse
Answer: correct-lamp-seven-river (four random words)
A passphrase of four random, unrelated words is long (24+ characters), genuinely random, and memorable. It defeats brute force through length and dictionary attacks through randomness. The other options use personal info, predictable substitutions, or dangerous reuse.
You have 47 online accounts. What is the most practical way to use a unique strong password for every one?
- Write them all in a notebook
- Use a password manager like Bitwarden or 1Password
- Use the same base password with the site name added at the end
- Only use strong passwords for important accounts and simple ones for the rest
Answer: Use a password manager like Bitwarden or 1Password
A password manager generates, stores, and auto-fills unique strong passwords for every site. You only need to remember one master password. Notebooks can be lost or seen. Base+site-name patterns are predictable and crackable. “Unimportant” accounts often have your email address — which can be used to reset passwords on important accounts.
Changing “password” to “p@ssw0rd” makes it significantly harder to crack.
- True
- False
Answer: False
All common letter-to-symbol substitutions (a→@, o→0, e→3, i→1, s→$) are included in every modern dictionary attack list. “p@ssw0rd” is cracked in seconds. Only genuine length and randomness provide real protection.
A website you used three years ago sends an email saying they had a data breach and your password may be exposed. What should you do first?
- Ignore it — you barely used that site
- Change your password on that site only
- Check if you used that same password anywhere else and change it on every site where you did
- Delete your account on the breached site
Answer: Check if you used that same password anywhere else and change it on every site where you did
The immediate danger is credential stuffing — attackers will try your leaked email/password combination on hundreds of other sites automatically. Every site where you reused that password is now compromised. Change all of them immediately, then use a password manager going forward to prevent this from happening again.
What is the single most effective additional control to add after using a strong unique password?
- Change your password every 30 days
- Use a longer password
- Enable multi-factor authentication (MFA)
- Use a different browser
Answer: Enable multi-factor authentication (MFA)
MFA means an attacker needs both your password AND your second factor (phone, authenticator app) to log in. Even if your password is stolen through phishing or a breach, MFA stops the attack. Microsoft found MFA blocks 99.9% of automated account compromise attempts.
Try it: Password strength check
Previous lesson: Common threats and attackers
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Multi-factor authentication