🎯 What you will learn
- By the end of this lesson you'll know what makes a password weak or strong.
- You'll be able to create a long passphrase that's easy to remember.
- You'll understand why reusing a password puts all your accounts at risk.
- You'll get to know password managers and how they work.
- You'll know what to do if your password has been exposed.
Why does your password matter so much?
A password is like the key to your digital home. It opens your email, your school account, your games, your social media and often your photos too. If someone gets hold of this key, they can log in as you, read your messages, send nasty things to your friends or change your password so that you can't get back in.
Most attacks aren't carried out by “genius hackers” but by automated programs that try millions of common passwords every second, or that use passwords stolen from other websites. That's why a good password protects you from most of the risks out there.
What makes a password weak?
A password is weak when it is short, predictable or used somewhere else. Typical examples:
- Numbers in a row or keyboard patterns: 123456, qwerty, 111111.
- Your name, your dog's name, your favourite team or your date of birth: Arta2012, Prishtina10.
- Common words with small changes that programs recognise: P@ssw0rd, Password1!.
- Anything your friends could guess just by looking at your social media profile.
Attackers' programs know all these “tricks”. Swapping a for @ or adding ! at the end doesn't make a password much stronger.
Length wins: passphrases
The most important rule today is: the longer, the stronger. An easy way to do this is a passphrase – a few random words joined together, which you remember like a little story.
- Pick 4–5 words that have no obvious connection to each other: tortoise, violin, hill, pizza.
- Join them with hyphens or spaces: tortoise-violin-hill-pizza.
- If the website asks for it, add a number or symbol somewhere in the middle: tortoise-violin7-hill-pizza.
- Picture it: “a tortoise playing the violin on a hill while eating pizza” – that way you won't forget it.
At least 12–16 characters is a good minimum; passphrases usually have more than 20.
Comparison: weak or strong?
| Example | Rating | Why? |
|---|---|---|
| 123456 | Very weak | The most-used password in the world; cracked instantly. |
| Blerim2011 | Weak | A name and year of birth – easy to guess. |
| P@ssw0rd! | Weak | A common word with substitutions that programs recognise. |
| kT9#qL2! | Medium | Random, but short and hard to remember. |
| tortoise-violin-hill-pizza | Strong | Long, made of random words and easy to remember. |
| Password created by a password manager (20+ characters) | Very strong | Completely random and unique for every website. |
One account = one password
Even the strongest password becomes risky if you use it in lots of places. Websites sometimes get attacked and lists of passwords end up being published. Attackers then try the same email and password on Instagram, Gmail, Roblox, TikTok… This is called “credential stuffing”.
If you've used the same password everywhere, a single leak from one small gaming website could open the door to all your accounts. So: every account gets its own password. Most important of all, your email should have a completely unique password, because your email can be used to reset all your other passwords.
You can check whether your email address has turned up in a known data breach at haveibeenpwned.com.
Password managers and passkeys
Nobody can remember 50 different passwords. That's what password managers are for – apps that keep all your passwords in an encrypted “safe”. You only need to remember one strong main password (a good passphrase), while the manager creates and fills in all the others for you.
- Built-in managers: in Google Chrome/Android (Google Password Manager) and on iPhone/Mac (Apple's Passwords app).
- Well-known standalone managers: Bitwarden, 1Password, Proton Pass and others.
- A password manager only fills in your password on the real website – so it also protects you from fake phishing pages.
Many websites now also offer passkeys: instead of typing a password, you confirm with your fingerprint, your face or your phone's PIN. Passkeys can't be stolen by fake websites, so they're a very safe choice whenever they're offered.
What should you do if your password has been exposed?
- Change it straight away on that account – to a new, long and unique one.
- If you've used the same password anywhere else, change it there too.
- Check the account for any sign-ins you don't recognise (many websites show a list of devices) and sign out of all devices.
- Turn on two-step verification (2FA).
- Tell a parent or teacher – asking for help doesn't mean you've done anything wrong.
📖 A real-life story
Blerim from Gjakova used the password Blerim2011 for his online game, his email and Instagram. One day, a small gaming website he had signed up to was attacked and its list of passwords was published. Two days later, his classmates told him that strange messages with links to “free Robux” were being sent from his Instagram account.
Blerim told his older sister straight away. Together they changed his email password to a long passphrase, then his Instagram and game passwords – each one different. They signed out of all the devices they didn't recognise, turned on 2FA and warned his friends not to click the links. Now Blerim uses his phone's password manager and only has to remember one passphrase.
✅ Do / Don't
✅ Do this
- Use passphrases of 4–5 random words, or passwords of at least 12–16 characters.
- Create a different password for every account.
- Give your email the strongest password – and make sure it's unique.
- Use a password manager, or passkeys when they're offered.
- Turn on two-step verification (2FA) on your important accounts.
- Change your password straight away if you think someone knows it.
- Log out when you use a school computer or someone else's.
- If you're young, share your password only with a parent – never with friends.
❌ Don't do this
- Don't use your name, your birthday, or your pet's or team's name.
- Don't use 123456, qwerty, password or any variation of them.
- Don't reuse the same password on several websites.
- Don't tell your password to your friends – not even your best friends.
- Don't write your password on a sticky note on your monitor or your desk.
- Don't save passwords in the browser on shared computers.
- Don't type your password in after following a link you got by email or text message.
- Don't give your password to anyone who says they're “from the staff”.
👨👩👧 For parents and teachers
Children often choose simple passwords because they're worried they'll forget them. Help them create fun passphrases – you can even turn it into a game: who can come up with the funniest four-word “story”?
- For children up to about 12, it's normal for a parent to know their passwords. Explain that this is about safety, not control.
- Set up a family password manager and turn on 2FA on your child's email.
- Check together on haveibeenpwned.com whether any of the family's email addresses have appeared in a data breach.
- Teachers can use the comparison table in class and practise with made-up passwords – never real ones.
- Keep repeating the key message: nobody trustworthy will ever ask for your password.
🧠 Mini-quiz
Answer 3 questions. Get at least 2 right and the lesson is marked as completed in your passport.