Good sites never store your password. They store a hash: a one-way scramble that is always the same for the same password, so a login can be checked, but can't be turned back. A salt makes the same password hash differently for each person. Public key encryption works like an open padlock: anyone can lock a message with it, but only the owner's private key opens it.
Websites get hacked and their password lists stolen. If the site did its job, the attackers still don't get your password. How?
This lesson covers two tools that protect data. A hash protects passwords where they are stored. Public key encryption protects secrets while they travel, and it is how HTTPS starts.
A hash turns any text into a fixed-length scramble. The same input always gives the same hash, but there is no way to work backwards from the hash to the input.
Predict: Read the problem and decide what you think before you try anything. A wrong guess is fine: it shows you what to look for.
Try: Try it on the board and compare the result with your prediction.
Investigate: Work out why it happens, one step at a time.
Modify: Change the problem on purpose and see what happens.
Practise: A few on your own, to check you have it.
Make: Make your own problem using what you have learned. Expect a few tries; that is normal.
Make your prediction first. Help opens once you've locked it in.
PredictRead the problem and decide what you think before you try anything. A wrong guess is fine: it shows you what to look for.
A stolen list
TryTry it on the board and compare the result with your prediction.
Try: sign in with a hash
Was your prediction right? Watch how many digits change for one letter.
Try it yourselfYour edits are saved in this browser.
The site stores only Sam's hash. Type Sam's password (maple). Then change one letter to a capital. What happens to the hash?
Use the board. This ticks when you get there.
InvestigateWork out why it happens, one step at a time.
Worked example: hashes and padlocks
Worked exampleBefore each step, say what you think comes next.
maple→49ead2b1066b…Hashing: a fixed-length scramble of the password.
sign in: hash(typed) = stored?The site compares hashes; it never needs the password.
Maple→a completely different hashOne small change changes everything, and it can't be reversed.
salt+mapleAdding each user's salt makes the same password hash differently for each person.
public key=open padlockAnyone can lock a message for Alice with it.
private key=the only keyOnly Alice can open it. HTTPS uses this to set up a secret with a website.
Now explain how a site checks a password.
Sam explains how Forgot password works. Click the line where it first goes wrong.
ModifyChange the problem on purpose and see what happens.
Vary: one change at a time
Try it yourselfYour edits are saved in this browser.
Type maple, then switch on the salt. Ana and Ben both use maple. Are their hashes the same?
Use the board. This ticks when you get there.
Bob locks the message with Alice's padlock and sends it.
Use the board. This ticks when you get there.
Now Bob uses his own padlock. Send it.
Use the board. This ticks when you get there.
Send it with no padlock.
Use the board. This ticks when you get there.
PractiseA few on your own, to check you have it.
Hashes and keys
MakeMake your own problem using what you have learned. Expect a few tries; that is normal.
A strong passphrase
Then: why should you never use the same password on two sites, even a strong one?
Try it yourselfYour edits are saved in this browser.
Need a hint?
Use four or more words that don't go together.
Another hint
Separate them with spaces or hyphens.
Another hint
Aim for 20 characters or more. Don't use a real password here.
Make up (don't use a real one) a passphrase of at least four unrelated words and 20 characters. Watch its hash.
Use the board. This ticks when you get there.
For teachers
Students sign in against a stored hash, see one letter change the whole hash, add a salt, and send a message locked with a public padlock past an eavesdropper, to explain how hashing protects stored passwords and public key encryption protects data in transit (AC9TDI10K01 node 4). About 45 minutes.
I can explain how sites check passwords without storing them.
I can explain what a salt adds.
I can explain how a public key and a private key work together.
Before class
Try the boards yourself. The hash is real SHA-256 (shown short); the passwords in the lesson are practice ones. Tell students never to type a real password into any board.
The kit's typical width: public key cryptography (as in TLS/HTTPS) secures data in transit; hashing secures stored passwords; they address different threats. Simplifications: the padlock is an analogy; HTTPS uses public keys to agree a shared key, then faster encryption for the rest.
Links: Secret messages' key sharing (agreeing a key in public) is the other half of how HTTPS starts.
Running the lesson
Predict: students who chose "your password" assume sites keep it.
Try: count how many digits changed for one letter.
Worked example: ask why the same password must always give the same hash.
Vary: ask why two identical hashes in a stolen list would be a giveaway without salt.
Make: remind students not to type a real password; it is a made-up passphrase.
The hard part (on purpose)
Hashing is one-way and the public key only locks: both run against intuition. Use the padlock and the meat grinder (you can't un-mince) as anchors.
When students get stuck
A student says the site turns the hash back (Sam's mistake). Ask: Why does the site send a reset link instead of your password? Fix: It can't reverse the hash.
A student thinks the public key opens the box. Ask: Eve has a padlock too. Can she open the box? Fix: Public keys only lock; the private key opens.
Stretch and support
Stretch: Why do security experts recommend a password manager? What does it change about using the same password on several sites?
Support: Two cards: Stored → hash (one way). Sent → public key locks, private key opens.
Where it leads
Next: Capture the flag (use everything from this course to find and fix the weaknesses in a school portal).
Links: Secret messages (key sharing, challenge and response).
What each step is for
a stolen list: Committing to what a stolen password list contains tests the new move: sites store hashes, which can be checked but not reversed.
Try: sign in with a hash: Typing the password and seeing its hash match the stored one settles the prediction: the site checks hashes, never storing the password.
Worked example: hashes and padlocks: Following a sign-in through hashing, then a message through a public padlock, models both tools. Sam thinks a hash can be turned back, the misconception planted after the method.
Vary: one change at a time: Each task changes one thing: a salt for the same password, then the lock Bob uses (Alice's, his own, none).
hashes and keys: Spotting good and bad password storage, choosing the right key, and a review of access control.
a strong passphrase: Building a passphrase that meets a strength rule reverses the process: students start from what makes a hash hard to guess and make a password to match.
Now you can
Explain how sites check passwords without storing them.
Explain what a salt adds.
Explain how a public key and a private key work together.