---
title: "When passwords fail"
subtitle: "Cyber safety and privacy · Protect your accounts · Lesson 1"
---

# When passwords fail

**Name:** {{field-24}} **Date:** {{field-15}} **Class:** {{field-15}}

> **Key question:** A game site Ava used once has just been hacked. Is her school email safe?


:::teacher-note

**In one sentence:** Students watch one leaked password open all of Ava's accounts, then stop the spread with a different long passphrase for each account and a password manager (AC9TDI8P13 node 1). A 5E mission lesson.

**Students should be able to say:** I can explain how a password gets out, and why reusing one makes it worse. I can say what makes a password hard to guess. I can set up accounts so one leak stays at one site.

**Width:** the unmarked parts are the floor every student does (Engage, Explore, Explain, Evaluate). Typical and Wider sections add contexts, not difficulty. Students work in the online tutorial alongside this sheet.

:::


## Engage


:::keep-together

**Ava uses the password sunshine1 for her school email, a game site, the club app and an online shop. The game site leaks its passwords. How many of her accounts are now open to someone else?**

☐ All four

☐ Just the game site

☐ None: the passwords were secret

☐ Two: the game site and the shop

My prediction, and why:

{{lines-3}}

:::


:::teacher-note

**What happens:** All four. Whoever has the leaked list tries the same password everywhere, and sunshine1 is on every list of common passwords anyway.

:::


## Explore

Try it on the board in the tutorial. Was your prediction right? What was different?

{{lines-2}}

## Explain: why passwords fail

What you just did has names. A **breach** is when a site's data leaks. **Reuse** turns one breach into many. Some passwords never needed a breach: they are **guessable**.

1. $\text{1. a site leaks}$ — You can't stop other sites being breached; you can limit the damage.
2. $\text{2. reuse spreads it}$ — The leaked password is tried on every other site. One password everywhere means one leak opens everything.
3. $\text{3. guessable falls first}$ — Common passwords, symbol swaps and personal details (names, birthdays, pets) are on the lists tried first.
4. $\text{fix: long, random, different}$ — Four random words for each site, kept in a password manager so you don't have to remember them.

### Find the mistake

:::keep-together

**Sam makes a stronger password. Click the line where it first goes wrong.**

```
 1  Sam's password used to be password.
 2  Sam changes it to P@ssw0rd! with symbols and capitals.
 3  Swapping letters for symbols makes it very hard to guess.
 4  So it is safe to use on every site.
```

Line: {{field-15}}

Why is it wrong?

{{lines-2}}

:::


:::teacher-note

**Answer:** line 3

Line 3: swaps like @ for a and 0 for o are so common that they are on the guessing lists too. Length and randomness make a password strong, and it still shouldn't be reused.

:::


:::typical

## Elaborate: a new set of problems

:::


## Make: Elaborate: let a manager do it


Work in the tutorial. Plan first: what will you change, and how will you test it?

{{box-4}}

## Exit ticket

:::keep-together

**Ava's game site leaks. Name two things that would have kept her other accounts safe.**

{{lines-3}}

:::


:::teacher-note

**Answer:** A different password on each account; long, random passphrases (not on any common list); a password manager to make and remember them.

:::