Password strength and phishing messages
Computer ScienceDigital Safety & EthicsAges 11–12
Use it with your class: students open it from a link or a QR code, with no account needed.
Next in Digital Safety & Ethics
Type a password and the program counts the character sets used (lowercase, uppercase, digits, symbols), then computes the number of combinations to try as R to the power L and divides by the guessing speed to get the cracking time. Students immediately see why adding one character, or one more character type, makes the cracking time jump. A second mode lets you click suspicious signals in phishing messages to learn to spot online scams.
Lesson: Cybersecurity: choosing a strong password, protecting accounts and recognizing online scams
What it shows
A brute-force attack tries every possible string until one matches. A password of length L built from R possible characters (26 lowercase, 26 uppercase, 10 digits, 33 symbols) has R^L combinations; dividing by the attacker's guessing speed gives the time to try them all. Each extra character multiplies that time by R, while a new character type only enlarges R, so length usually matters most. The second mode trains students to spot phishing signals such as urgency, fake prizes, odd links and requests for OTP codes.
How to use
Start from the Starting password and read the breakdown of R, L and the time. Add one character, then instead add one new character type, and compare how much the time grows each way. Press Try a weak password and Suggest a strong password to contrast their checklists, and raise the Attacker's guessing speed to model faster hardware. Finally open the Phishing message tab, let students click every part they find suspicious, and press Reveal the answer to discuss each signal.
Parameters you can change
- Starting password
- Attacker's guessing speed 1–10000 million attempts/s
- Minimum length considered safe 6–20 characters
- Content Estimate password-cracking time, Spot phishing messages
- Show strong-password tips
Questions to explore
- Why is the starting password weak even though it mixes letters and digits?
- Using R^L, which increases the cracking time more: adding one character or adding a new character type?
- Which signals in a phishing message should make you stop before clicking a link or replying?
