- Computers and coding
- Classes 9-10
- 6 min read
Passwords, encryption basics and two-factor
Make strong passwords, see how a Caesar cipher scrambles a message and why a key matters, and learn how two-factor login adds a second lock.
Let us begin
The big idea
A password is a secret that proves you are you. Encryption is a way to scramble information so only someone with the key can read it. Together with a second check called two-factor authentication, they keep accounts and messages safe. You can practise all three on paper.
A strong password is long, hard to guess and used for only one account. Length matters most: each extra character multiplies the number of guesses an attacker must try. A short phrase of unrelated words with a number and a symbol, such as "mango!tractor7cloud", is both long and easy to remember. Never use your name, birthday, "123456" or "password", and never share a password, even with a friend.
Encryption turns readable text (plaintext) into scrambled text (ciphertext) using a rule and a key. The oldest example is the Caesar cipher: shift every letter forward by a fixed number. With key 3, A becomes D, B becomes E, and Z wraps round to C. To decrypt, shift back by the same key. Anyone can know the rule; the key is the secret.
A Caesar cipher is easy to break because there are only 25 useful keys, so an attacker can simply try them all. Modern encryption, such as the kind behind HTTPS, uses keys that are hundreds of digits long, so trying every key would take longer than the age of the universe. The idea is the same: a public rule, a secret key.
Two-factor authentication (2FA) asks for two different kinds of proof: something you know (the password) and something you have (your phone, which receives a one-time code, or an authenticator app). If someone steals your password, they still cannot log in without your phone. Turn it on for important accounts, with an adult's help.
Worked examples
See how it works
Encrypting with Caesar, key 3
Plaintext HELLO. H plus 3 is K, E plus 3 is H, L plus 3 is O, L plus 3 is O, O plus 3 is R. Ciphertext: KHOOR. To decrypt KHOOR, shift each letter back 3 and HELLO returns.
Wrapping round the alphabet
Encrypt XYZ with key 4. X plus 4: X, Y, Z, then wrap to A, B, so X becomes B. Y becomes C. Z becomes D. Ciphertext: BCD.
Comparing passwords
"rahul2010" is weak: it is a name plus a birth year, both easy to find out. "Tj7" is short, so a computer can try every three-character combination in seconds. "purple!river42kite" is 18 characters of unrelated words, so it is strong and still memorable.
How 2FA stops a thief
Someone learns Meera's email password from a leaked website. They type it in, but the site then asks for the six-digit code sent to Meera's phone. The thief does not have her phone, so the login fails, and Meera gets a warning to change her password.
Try it at home
Secret messages with a paper cipher wheel
You will need
- Two strips of paper
- A pencil
- A ruler or a straight edge
What to do
- On both strips write the alphabet A to Z with equal spacing. On the second strip, write it twice in a row so it is twice as long.
- Place the short strip above the long one and slide it so that A on the short strip sits above D on the long strip. That is key 3.
- Encrypt a short message by reading each letter on the short strip and writing the letter below it on the long strip.
- Give the ciphertext and the key to a family member and have them decrypt it by reading upwards.
- Now give them only the ciphertext and see how long it takes them to try all the keys. Discuss why real encryption needs much bigger keys.
Practice sheet
Check what you learned
Practice sheet: Passwords, encryption basics and two-factor (Classes 9-10, Computers and coding)
- Give two features of a strong password.
- Why is "priya2011" a weak password?
- Encrypt CAB with a Caesar cipher, key 3.
- Decrypt MDO (key 3).
- Encrypt ZOO with key 2.
- What is the difference between the rule and the key in a cipher?
- Why is a Caesar cipher easy to break?
- What are the two factors in two-factor authentication?
- A thief knows your password but not your phone. Can they log in to a 2FA account?
- What is the padlock in a browser address bar telling you?
- Should you use the same password for every account? Why or why not?
Answer key
Answers: Passwords, encryption basics and two-factor
- Any two of: long, hard to guess, not based on personal details, used for only one account, mixes words with numbers and symbols.
- It is a name plus a birth year, both easy to find out or guess.
- FDE
- JAL
- BQQ: Z wraps to B, O becomes Q, O becomes Q.
- The rule is the method (shift letters) and can be public; the key is the secret number that makes the scrambling unique.
- There are only 25 useful keys, so an attacker can try every one in minutes.
- Something you know (a password) and something you have (your phone or an authenticator app).
- No; the site also asks for the one-time code on the phone, which the thief does not have.
- That the connection uses HTTPS, so data between you and the site is encrypted.
- No; if one site leaks the password, every account using it is open to attack.