Learning objective
Passwords
Passwords & Authentication
1
2
3
4
5
6
Understanding how passwords, passphrases, biometric security, and multi-factor authentication protect personal accounts, identity, and digital devices across online systems.
Secret Keys
Recognize that a password is a secret code used to lock digital accounts and prove user identity.
Let's Go!
Routine: See-Think-Wonder
Look at a padlocked treasure chest and a tablet login screen. How are they similar?
Teacher note: Facilitate the See-Think-Wonder routine for 2–3 minutes. Encourage students to connect the prompt to Form (Digital accounts require secret keys to ensure personal safety and privacy.).
Learn
A password is like a digital key to your personal locker. When you type your secret password, the computer checks if it matches before opening your personal files and apps. In computing, digital accounts require secret keys to ensure personal safety and privacy. As you explore the interactive Password Meter Simulator below, focus on how to create a simple secret password and keeps it hidden during login.
🛡️ Interactive Password & Credential Meter
Ready for InputEntropy: 0 bits
Complexity & Security Checklist:
- Length: At least 10 characters long
- Uppercase: Contains capital letter (A-Z)
- Numbers: Contains digit (0-9)
- Special Symbol: Contains (!, @, #, $, %, ^, &, *)
🧮 Shannon Entropy Calculation Formula
Password entropy measures information randomness in bits ($H = L \times \log_2(N)$):
H = Total entropy in bits
L = Character length of password
N = Character pool size (Lowercase: 26, Alphanumeric: 62, Full ASCII: 94)
Example for 10-char mixed: 10 × log2(94) = 65.5 bits
⚡ High-Performance Cracking Hardware Benchmarks
Time required to brute-force all combinations at various hashing speeds:
| Hardware Class | Hash Rate | 8-Char Weak | 14-Char Passphrase |
|---|---|---|---|
| Consumer CPU | 100M hashes/s | 2.4 hours | 340,000 years |
| 8x RTX 4090 GPU Rig | 100B hashes/s | 8.6 seconds | 340 years |
| Nation-State Cluster | 10T hashes/s | < 0.1 sec | 3.4 years |
📋 Encrypted Vault Credential Database
Simulated client-side zero-knowledge encrypted credential repository:
| Service | Username | Generated Password | Entropy |
|---|---|---|---|
| School Portal | [email protected] | k9#mP!2$vR8*xL5q | 94 bits |
| Google Classroom | [email protected] | wB4$tZ7@nC9#mQ2x | 94 bits |
| Coding Platform | alex_coder_01 | pL8#vX2$jR6@kM4w | 94 bits |
📖 NIST 800-63B Authentication Standards
1. Prioritize Length Over Arbitrary Rules:Passphrases of 16+ characters provide exponential resistance compared to forcing periodic 60-day password resets.
2. Screen Against Breached Passwords:Check against known exposed credential lists (HaveIBeenPwned API) to block compromised passwords.
3. Enforce Multi-Factor Authentication:MFA blocks 99.9% of automated credential stuffing attacks even when passwords are breached.
Apply Simulator Skills • Try it yourself
Practice Secret Login
🚀 Open a practice space
🌟 Student Project GuideSuccess Criteria & WAGOLL (What A Good One Looks Like)
🎯 Task Success Criteria (Rubric)
Foundation
Identifies that accounts need a secret lock.
Developing
Explains that a password proves identity to open an account.
Secure (Goal)
Creates a simple secret password and keeps it hidden during login.
Mastery
Explains why sharing passwords with peers compromises digital security.
👀 What A Good One Looks Like (WAGOLL)
⭐ Mastering Standard📁
Save to Your Website Portfolio:
When you finish creating your project in your software, copy the share link or take a screenshot and publish it onto your student portfolio website!
Reflect
Learning check
Teacher setup, curriculum links and progress descriptors
Spark support
Routine: See-Think-Wonder
Teacher notes: Facilitate the See-Think-Wonder routine for 2–3 minutes. Encourage students to connect the prompt to Form (Digital accounts require secret keys to ensure personal safety and privacy.).
Achievement pathway
- Foundation: Identifies that accounts need a secret lock.
- Developing: Explains that a password proves identity to open an account.
- Secure: Creates a simple secret password and keeps it hidden during login.
- Mastering: Explains why sharing passwords with peers compromises digital security.
Curriculum links
Curriculum strand: Online Safety & Digital Citizenship
Outcome: PASS.01.B.1.1 — Recognize that a password is a secret code used to lock digital accounts and prove user identity.
PYP: Form · Digital accounts require secret keys to ensure personal safety and privacy.
Learner profile: Inquirer
Competency tags
Gate support
Accessibility alternative: Students may verbally explain or point to the correct answer for "What is the main purpose of a password?" with a teacher or teaching assistant.
Teacher override: allow
Locked level
Level 2: Strong Combinations
Complete the previous learning check to unlock this next level.
Strong Combinations
Construct strong passwords using combinations of uppercase letters, numbers, and symbols.
Learning objective
Students will design strong passwords by combining uppercase letters, lowercase letters, numbers, and special symbols rather than simple words.
Let's Go!
Routine: Think-Pair-Share
Which door lock is harder to guess: a 2-digit dial or a 6-symbol vault code?
Why?
Teacher note: Facilitate the Think-Pair-Share routine for 2–3 minutes. Encourage students to connect the prompt to Function (Building strong security combinations protects digital spaces from unauthorized access.).
Learn
Weak passwords like "password123" or "abc" are easy for guessing algorithms to break. Strong passwords mix capital letters, small letters, numbers, and symbols (like ! or #) to create a complex secret. In computing, building strong security combinations protects digital spaces from unauthorized access. As you explore the interactive Password Meter Simulator below, focus on how to create strong passwords with uppercase, lowercase, numbers, and symbols.
🛡️ Interactive Password & Credential Meter
Ready for InputEntropy: 0 bits
Complexity & Security Checklist:
- Length: At least 10 characters long
- Uppercase: Contains capital letter (A-Z)
- Numbers: Contains digit (0-9)
- Special Symbol: Contains (!, @, #, $, %, ^, &, *)
🧮 Shannon Entropy Calculation Formula
Password entropy measures information randomness in bits ($H = L \times \log_2(N)$):
H = Total entropy in bits
L = Character length of password
N = Character pool size (Lowercase: 26, Alphanumeric: 62, Full ASCII: 94)
Example for 10-char mixed: 10 × log2(94) = 65.5 bits
⚡ High-Performance Cracking Hardware Benchmarks
Time required to brute-force all combinations at various hashing speeds:
| Hardware Class | Hash Rate | 8-Char Weak | 14-Char Passphrase |
|---|---|---|---|
| Consumer CPU | 100M hashes/s | 2.4 hours | 340,000 years |
| 8x RTX 4090 GPU Rig | 100B hashes/s | 8.6 seconds | 340 years |
| Nation-State Cluster | 10T hashes/s | < 0.1 sec | 3.4 years |
📋 Encrypted Vault Credential Database
Simulated client-side zero-knowledge encrypted credential repository:
| Service | Username | Generated Password | Entropy |
|---|---|---|---|
| School Portal | [email protected] | k9#mP!2$vR8*xL5q | 94 bits |
| Google Classroom | [email protected] | wB4$tZ7@nC9#mQ2x | 94 bits |
| Coding Platform | alex_coder_01 | pL8#vX2$jR6@kM4w | 94 bits |
📖 NIST 800-63B Authentication Standards
1. Prioritize Length Over Arbitrary Rules:Passphrases of 16+ characters provide exponential resistance compared to forcing periodic 60-day password resets.
2. Screen Against Breached Passwords:Check against known exposed credential lists (HaveIBeenPwned API) to block compromised passwords.
3. Enforce Multi-Factor Authentication:MFA blocks 99.9% of automated credential stuffing attacks even when passwords are breached.
Apply Simulator Skills • Try it yourself
Build a Strong Password
🚀 Open a practice space
🌟 Student Project GuideSuccess Criteria & WAGOLL (What A Good One Looks Like)
🎯 Task Success Criteria (Rubric)
Foundation
Recognizes that short passwords like "1234" are weak.
Developing
Combines letters and numbers to improve password strength.
Secure (Goal)
Creates strong passwords with uppercase, lowercase, numbers, and symbols.
Mastery
Evaluates password complexity and identifies common weak patterns.
👀 What A Good One Looks Like (WAGOLL)
⭐ Mastering Standard📁
Save to Your Website Portfolio:
When you finish creating your project in your software, copy the share link or take a screenshot and publish it onto your student portfolio website!
Reflect
Learning check
Teacher setup, curriculum links and progress descriptors
Spark support
Routine: Think-Pair-Share
Teacher notes: Facilitate the Think-Pair-Share routine for 2–3 minutes. Encourage students to connect the prompt to Function (Building strong security combinations protects digital spaces from unauthorized access.).
Achievement pathway
- Foundation: Recognizes that short passwords like "1234" are weak.
- Developing: Combines letters and numbers to improve password strength.
- Secure: Creates strong passwords with uppercase, lowercase, numbers, and symbols.
- Mastering: Evaluates password complexity and identifies common weak patterns.
Curriculum links
Curriculum strand: Online Safety & Digital Citizenship
Outcome: PASS.02.B.1.2 — Construct strong passwords using combinations of uppercase letters, numbers, and symbols.
PYP: Function · Building strong security combinations protects digital spaces from unauthorized access.
Learner profile: Communicator
Competency tags
Gate support
Accessibility alternative: Students may verbally explain or point to the correct answer for "Which of these is the STRONGEST password?" with a teacher or teaching assistant.
Teacher override: allow
Locked level
Level 3: Keeping Secrets
Complete the previous learning check to unlock this next level.
Keeping Secrets
Understand why passwords must never be shared with peers or entered on untrusted devices.
Learning objective
Students will identify who can be trusted with passwords (parents/teachers only) and recognize the risks of sharing login credentials with friends.
Let's Go!
Routine: Connect-Extend-Challenge
If you gave a friend your house key, could they let someone else in?
How does this apply to passwords?
Teacher note: Facilitate the Connect-Extend-Challenge routine for 2–3 minutes. Encourage students to connect the prompt to Connection (Maintaining personal digital boundaries preserves trust and protects online identity.).
Learn
Your password is strictly private. Even best friends should never share passwords, because shared credentials can lead to accidental file deletion, impersonation, or compromised privacy. Only parents and teachers may help manage passwords. In computing, maintaining personal digital boundaries preserves trust and protects online identity. As you explore the interactive Password Meter Simulator below, focus on how to demonstrate safe habits when logging in near others without exposing credentials.
🛡️ Interactive Password & Credential Meter
Ready for InputEntropy: 0 bits
Complexity & Security Checklist:
- Length: At least 10 characters long
- Uppercase: Contains capital letter (A-Z)
- Numbers: Contains digit (0-9)
- Special Symbol: Contains (!, @, #, $, %, ^, &, *)
🧮 Shannon Entropy Calculation Formula
Password entropy measures information randomness in bits ($H = L \times \log_2(N)$):
H = Total entropy in bits
L = Character length of password
N = Character pool size (Lowercase: 26, Alphanumeric: 62, Full ASCII: 94)
Example for 10-char mixed: 10 × log2(94) = 65.5 bits
⚡ High-Performance Cracking Hardware Benchmarks
Time required to brute-force all combinations at various hashing speeds:
| Hardware Class | Hash Rate | 8-Char Weak | 14-Char Passphrase |
|---|---|---|---|
| Consumer CPU | 100M hashes/s | 2.4 hours | 340,000 years |
| 8x RTX 4090 GPU Rig | 100B hashes/s | 8.6 seconds | 340 years |
| Nation-State Cluster | 10T hashes/s | < 0.1 sec | 3.4 years |
📋 Encrypted Vault Credential Database
Simulated client-side zero-knowledge encrypted credential repository:
| Service | Username | Generated Password | Entropy |
|---|---|---|---|
| School Portal | [email protected] | k9#mP!2$vR8*xL5q | 94 bits |
| Google Classroom | [email protected] | wB4$tZ7@nC9#mQ2x | 94 bits |
| Coding Platform | alex_coder_01 | pL8#vX2$jR6@kM4w | 94 bits |
📖 NIST 800-63B Authentication Standards
1. Prioritize Length Over Arbitrary Rules:Passphrases of 16+ characters provide exponential resistance compared to forcing periodic 60-day password resets.
2. Screen Against Breached Passwords:Check against known exposed credential lists (HaveIBeenPwned API) to block compromised passwords.
3. Enforce Multi-Factor Authentication:MFA blocks 99.9% of automated credential stuffing attacks even when passwords are breached.
Apply Simulator Skills • Try it yourself
Privacy Audit Challenge
🚀 Open a practice space
🌟 Student Project GuideSuccess Criteria & WAGOLL (What A Good One Looks Like)
🎯 Task Success Criteria (Rubric)
Foundation
States that passwords should not be told to classmates.
Developing
Explains that sharing passwords allows others to impersonate you online.
Secure (Goal)
Demonstrates safe habits when logging in near others without exposing credentials.
Mastery
Analyzes scenario dilemmas involving peer pressure to share account logins.
👀 What A Good One Looks Like (WAGOLL)
⭐ Mastering Standard📁
Save to Your Website Portfolio:
When you finish creating your project in your software, copy the share link or take a screenshot and publish it onto your student portfolio website!
Reflect
Learning check
Teacher setup, curriculum links and progress descriptors
Spark support
Routine: Connect-Extend-Challenge
Teacher notes: Facilitate the Connect-Extend-Challenge routine for 2–3 minutes. Encourage students to connect the prompt to Connection (Maintaining personal digital boundaries preserves trust and protects online identity.).
Achievement pathway
- Foundation: States that passwords should not be told to classmates.
- Developing: Explains that sharing passwords allows others to impersonate you online.
- Secure: Demonstrates safe habits when logging in near others without exposing credentials.
- Mastering: Analyzes scenario dilemmas involving peer pressure to share account logins.
Curriculum links
Curriculum strand: Online Safety & Digital Citizenship
Outcome: PASS.03.B.1.3 — Understand why passwords must never be shared with peers or entered on untrusted devices.
PYP: Connection · Maintaining personal digital boundaries preserves trust and protects online identity.
Learner profile: Principled
Competency tags
Gate support
Accessibility alternative: Students may verbally explain or point to the correct answer for "Who is it safe to share your account password with?" with a teacher or teaching assistant.
Teacher override: allow
Locked level
Level 4: Passphrases
Complete the previous learning check to unlock this next level.
Passphrases
Design memorable passphrases composed of multiple random words to improve security.
Learning objective
Students will create passphrases by linking 4 or more random, unrelated words together to maximize entropy and memorable security.
Let's Go!
Routine: Chalk Talk
Which is easier to remember: "tr0ub4do3!" or "PurpleTurtleDancingMoon"?
Which is stronger?
Teacher note: Facilitate the Chalk Talk routine for 2–3 minutes. Encourage students to connect the prompt to Responsibility (Combining length and randomness creates memorable yet secure security phrases.).
Learn
A passphrase joins several random words into a long string (e.g., "coffee-robot-flying-banana"). Passphrases are easier for humans to remember but extremely difficult for automated computers to crack because of their long character length. In computing, combining length and randomness creates memorable yet secure security phrases. As you explore the interactive Password Meter Simulator below, focus on how to construct a 4-word random passphrase with spaces, numbers, or symbols.
🛡️ Interactive Password & Credential Meter
Ready for InputEntropy: 0 bits
Complexity & Security Checklist:
- Length: At least 10 characters long
- Uppercase: Contains capital letter (A-Z)
- Numbers: Contains digit (0-9)
- Special Symbol: Contains (!, @, #, $, %, ^, &, *)
🧮 Shannon Entropy Calculation Formula
Password entropy measures information randomness in bits ($H = L \times \log_2(N)$):
H = Total entropy in bits
L = Character length of password
N = Character pool size (Lowercase: 26, Alphanumeric: 62, Full ASCII: 94)
Example for 10-char mixed: 10 × log2(94) = 65.5 bits
⚡ High-Performance Cracking Hardware Benchmarks
Time required to brute-force all combinations at various hashing speeds:
| Hardware Class | Hash Rate | 8-Char Weak | 14-Char Passphrase |
|---|---|---|---|
| Consumer CPU | 100M hashes/s | 2.4 hours | 340,000 years |
| 8x RTX 4090 GPU Rig | 100B hashes/s | 8.6 seconds | 340 years |
| Nation-State Cluster | 10T hashes/s | < 0.1 sec | 3.4 years |
📋 Encrypted Vault Credential Database
Simulated client-side zero-knowledge encrypted credential repository:
| Service | Username | Generated Password | Entropy |
|---|---|---|---|
| School Portal | [email protected] | k9#mP!2$vR8*xL5q | 94 bits |
| Google Classroom | [email protected] | wB4$tZ7@nC9#mQ2x | 94 bits |
| Coding Platform | alex_coder_01 | pL8#vX2$jR6@kM4w | 94 bits |
📖 NIST 800-63B Authentication Standards
1. Prioritize Length Over Arbitrary Rules:Passphrases of 16+ characters provide exponential resistance compared to forcing periodic 60-day password resets.
2. Screen Against Breached Passwords:Check against known exposed credential lists (HaveIBeenPwned API) to block compromised passwords.
3. Enforce Multi-Factor Authentication:MFA blocks 99.9% of automated credential stuffing attacks even when passwords are breached.
Apply Simulator Skills • Try it yourself
Craft a Passphrase
🚀 Open a practice space
🌟 Student Project GuideSuccess Criteria & WAGOLL (What A Good One Looks Like)
🎯 Task Success Criteria (Rubric)
Foundation
Recognizes that longer passphrases are harder to guess than short passwords.
Developing
Combines 3 random words to form a simple passphrase.
Secure (Goal)
Constructs a 4-word random passphrase with spaces, numbers, or symbols.
Mastery
Explains why passphrase length provides high resistance against brute-force attacks.
👀 What A Good One Looks Like (WAGOLL)
⭐ Mastering Standard📁
Save to Your Website Portfolio:
When you finish creating your project in your software, copy the share link or take a screenshot and publish it onto your student portfolio website!
Reflect
Learning check
Teacher setup, curriculum links and progress descriptors
Spark support
Routine: Chalk Talk
Teacher notes: Facilitate the Chalk Talk routine for 2–3 minutes. Encourage students to connect the prompt to Responsibility (Combining length and randomness creates memorable yet secure security phrases.).
Achievement pathway
- Foundation: Recognizes that longer passphrases are harder to guess than short passwords.
- Developing: Combines 3 random words to form a simple passphrase.
- Secure: Constructs a 4-word random passphrase with spaces, numbers, or symbols.
- Mastering: Explains why passphrase length provides high resistance against brute-force attacks.
Curriculum links
Curriculum strand: Online Safety & Digital Citizenship
Outcome: PASS.04.B.1.4 — Design memorable passphrases composed of multiple random words to improve security.
PYP: Responsibility · Combining length and randomness creates memorable yet secure security phrases.
Learner profile: Thinker
Competency tags
Gate support
Accessibility alternative: Students may verbally explain or point to the correct answer for "Why are long passphrases (like "GreenMonkeyJumpsHigh") effective?" with a teacher or teaching assistant.
Teacher override: allow
Locked level
Level 5: MFA & Security
Complete the previous learning check to unlock this next level.
MFA & Security
Explain how multi-factor authentication (MFA) and biometrics add essential extra security layers.
Learning objective
Students will understand multi-factor authentication (something you know + something you have/are) and explain how 2FA blocks unauthorized logins.
Let's Go!
Routine: 4 Cs (Connections, Concepts, Changes, Challenges)
Why do high-security banks require both a card key AND a passcode to enter?
Teacher note: Facilitate the 4 Cs (Connections, Concepts, Changes, Challenges) routine for 2–3 minutes. Encourage students to connect the prompt to Perspective (Multi-layered authentication systems defend identity across global digital networks.).
Learn
Multi-Factor Authentication (MFA) requires two or more proofs of identity before logging in. Factors include: 1) Something you know (password), 2) Something you have (authenticator code/phone), 3) Something you are (fingerprint or face scan). In computing, multi-layered authentication systems defend identity across global digital networks. As you explore the interactive Password Meter Simulator below, focus on how to categorize authentication factors: something you know, have, or are.
🛡️ Interactive Password & Credential Meter
Ready for InputEntropy: 0 bits
Complexity & Security Checklist:
- Length: At least 10 characters long
- Uppercase: Contains capital letter (A-Z)
- Numbers: Contains digit (0-9)
- Special Symbol: Contains (!, @, #, $, %, ^, &, *)
🧮 Shannon Entropy Calculation Formula
Password entropy measures information randomness in bits ($H = L \times \log_2(N)$):
H = Total entropy in bits
L = Character length of password
N = Character pool size (Lowercase: 26, Alphanumeric: 62, Full ASCII: 94)
Example for 10-char mixed: 10 × log2(94) = 65.5 bits
⚡ High-Performance Cracking Hardware Benchmarks
Time required to brute-force all combinations at various hashing speeds:
| Hardware Class | Hash Rate | 8-Char Weak | 14-Char Passphrase |
|---|---|---|---|
| Consumer CPU | 100M hashes/s | 2.4 hours | 340,000 years |
| 8x RTX 4090 GPU Rig | 100B hashes/s | 8.6 seconds | 340 years |
| Nation-State Cluster | 10T hashes/s | < 0.1 sec | 3.4 years |
📋 Encrypted Vault Credential Database
Simulated client-side zero-knowledge encrypted credential repository:
| Service | Username | Generated Password | Entropy |
|---|---|---|---|
| School Portal | [email protected] | k9#mP!2$vR8*xL5q | 94 bits |
| Google Classroom | [email protected] | wB4$tZ7@nC9#mQ2x | 94 bits |
| Coding Platform | alex_coder_01 | pL8#vX2$jR6@kM4w | 94 bits |
📖 NIST 800-63B Authentication Standards
1. Prioritize Length Over Arbitrary Rules:Passphrases of 16+ characters provide exponential resistance compared to forcing periodic 60-day password resets.
2. Screen Against Breached Passwords:Check against known exposed credential lists (HaveIBeenPwned API) to block compromised passwords.
3. Enforce Multi-Factor Authentication:MFA blocks 99.9% of automated credential stuffing attacks even when passwords are breached.
Apply Simulator Skills • Try it yourself
Simulate 2FA Security Step
🚀 Open a practice space
🌟 Student Project GuideSuccess Criteria & WAGOLL (What A Good One Looks Like)
🎯 Task Success Criteria (Rubric)
Foundation
Identifies secondary login checks like phone codes or fingerprints.
Developing
Explains that 2FA requires two separate proofs of identity before unlocking.
Secure (Goal)
Categorizes authentication factors: something you know, have, or are.
Mastery
Evaluates how 2FA protects accounts even if a password is stolen.
👀 What A Good One Looks Like (WAGOLL)
⭐ Mastering Standard📁
Save to Your Website Portfolio:
When you finish creating your project in your software, copy the share link or take a screenshot and publish it onto your student portfolio website!
Reflect
Learning check
Teacher setup, curriculum links and progress descriptors
Spark support
Routine: 4 Cs (Connections, Concepts, Changes, Challenges)
Teacher notes: Facilitate the 4 Cs (Connections, Concepts, Changes, Challenges) routine for 2–3 minutes. Encourage students to connect the prompt to Perspective (Multi-layered authentication systems defend identity across global digital networks.).
Achievement pathway
- Foundation: Identifies secondary login checks like phone codes or fingerprints.
- Developing: Explains that 2FA requires two separate proofs of identity before unlocking.
- Secure: Categorizes authentication factors: something you know, have, or are.
- Mastering: Evaluates how 2FA protects accounts even if a password is stolen.
Curriculum links
Curriculum strand: Online Safety & Digital Citizenship
Outcome: PASS.05.B.1.5 — Explain how multi-factor authentication (MFA) and biometrics add essential extra security layers.
PYP: Perspective · Multi-layered authentication systems defend identity across global digital networks.
Learner profile: Knowledgeable
Competency tags
Gate support
Accessibility alternative: Students may verbally explain or point to the correct answer for "What are the two factors in Two-Factor Authentication (2FA)?" with a teacher or teaching assistant.
Teacher override: allow
Locked level
Level 6: Password Managers
Complete the previous learning check to unlock this next level.
Password Managers
Evaluate credential management strategies and password manager tools for long-term security.
Learning objective
Students will analyze the danger of password reuse across accounts and explain how encrypted password managers securely store unique credentials.
Let's Go!
Routine: I Used to Think... Now I Think...
I used to think using one easy password for every website was smart. Now I think...
Teacher note: Facilitate the I Used to Think... Now I Think... routine for 2–3 minutes. Encourage students to connect the prompt to Reflection (Systematic credential management safeguards digital identity across complex digital environments.).
Learn
Reusing the same password across multiple websites creates a domino effect: if one site gets breached, all your accounts become vulnerable. A Password Manager acts as a secure digital vault locked by one strong Master Passphrase, automatically generating unique, uncrackable passwords for every account.
🛡️ Interactive Password & Credential Meter
Ready for InputEntropy: 0 bits
Complexity & Security Checklist:
- Length: At least 10 characters long
- Uppercase: Contains capital letter (A-Z)
- Numbers: Contains digit (0-9)
- Special Symbol: Contains (!, @, #, $, %, ^, &, *)
🧮 Shannon Entropy Calculation Formula
Password entropy measures information randomness in bits ($H = L \times \log_2(N)$):
H = Total entropy in bits
L = Character length of password
N = Character pool size (Lowercase: 26, Alphanumeric: 62, Full ASCII: 94)
Example for 10-char mixed: 10 × log2(94) = 65.5 bits
⚡ High-Performance Cracking Hardware Benchmarks
Time required to brute-force all combinations at various hashing speeds:
| Hardware Class | Hash Rate | 8-Char Weak | 14-Char Passphrase |
|---|---|---|---|
| Consumer CPU | 100M hashes/s | 2.4 hours | 340,000 years |
| 8x RTX 4090 GPU Rig | 100B hashes/s | 8.6 seconds | 340 years |
| Nation-State Cluster | 10T hashes/s | < 0.1 sec | 3.4 years |
📋 Encrypted Vault Credential Database
Simulated client-side zero-knowledge encrypted credential repository:
| Service | Username | Generated Password | Entropy |
|---|---|---|---|
| School Portal | [email protected] | k9#mP!2$vR8*xL5q | 94 bits |
| Google Classroom | [email protected] | wB4$tZ7@nC9#mQ2x | 94 bits |
| Coding Platform | alex_coder_01 | pL8#vX2$jR6@kM4w | 94 bits |
📖 NIST 800-63B Authentication Standards
1. Prioritize Length Over Arbitrary Rules:Passphrases of 16+ characters provide exponential resistance compared to forcing periodic 60-day password resets.
2. Screen Against Breached Passwords:Check against known exposed credential lists (HaveIBeenPwned API) to block compromised passwords.
3. Enforce Multi-Factor Authentication:MFA blocks 99.9% of automated credential stuffing attacks even when passwords are breached.
Apply Simulator Skills • Try it yourself
Credential Audit & Vault Exercise
🚀 Open a practice space
🌟 Student Project GuideSuccess Criteria & WAGOLL (What A Good One Looks Like)
🎯 Task Success Criteria (Rubric)
Foundation
Recognizes that using one password everywhere is risky.
Developing
Explains that password managers store unique passwords in an encrypted vault.
Secure (Goal)
Audits account credential lists to eliminate reused passwords.
Mastery
Designs a credential management policy incorporating master passphrases, encrypted vaults, and zero-trust principles.
👀 What A Good One Looks Like (WAGOLL)
⭐ Mastering Standard📁
Save to Your Website Portfolio:
When you finish creating your project in your software, copy the share link or take a screenshot and publish it onto your student portfolio website!
Reflect
Learning check
Teacher setup, curriculum links and progress descriptors
Spark support
Routine: I Used to Think... Now I Think...
Teacher notes: Facilitate the I Used to Think... Now I Think... routine for 2–3 minutes. Encourage students to connect the prompt to Reflection (Systematic credential management safeguards digital identity across complex digital environments.).
Achievement pathway
- Foundation: Recognizes that using one password everywhere is risky.
- Developing: Explains that password managers store unique passwords in an encrypted vault.
- Secure: Audits account credential lists to eliminate reused passwords.
- Mastering: Designs a credential management policy incorporating master passphrases, encrypted vaults, and zero-trust principles.
Curriculum links
Curriculum strand: Online Safety & Digital Citizenship
Outcome: PASS.06.B.1.6 — Evaluate credential management strategies and password manager tools for long-term security.
PYP: Reflection · Systematic credential management safeguards digital identity across complex digital environments.
Learner profile: Reflective
Competency tags
Gate support
Accessibility alternative: Students may verbally explain or point to the correct answer for "Why is password reuse across multiple websites dangerous?" with a teacher or teaching assistant.
Teacher override: allow