Why unique passwords matter
Children often reuse passwords because it is easier to remember one thing. The problem is that if one website loses or exposes that password, someone may try the same email address and password on other services.
A simple way to explain this is to compare passwords with keys. If every door used the same key, losing one key could open everything. Different important accounts should not all depend on the same secret.
Long and memorable beats short and clever
For accounts where a child must remember the password, a longer passphrase can be easier to remember than a short string of random substitutions. The exact rules depend on the service, but length and uniqueness are more useful ideas to teach than simply replacing letters with numbers.
Avoid building passwords from obvious personal details such as a child's name, birthday, school, sports team or pet when those details may be easy for other people to learn.
Use a password manager when appropriate
Families can reduce password reuse by using a reputable password manager. This allows each account to have a different password without expecting a child to memorise every one of them.
For younger children, a parent or carer may manage important account credentials. As children become more independent, the password manager can become part of teaching them how to handle access responsibly.
Sign-in codes are private too
Children may understand that passwords are private but still treat one-time sign-in codes as harmless. A verification code can sometimes be exactly what another person needs to finish signing in.
A useful family rule is: never send a password or sign-in code to someone who asks for it in a message. If a code arrives unexpectedly, do not approve anything; check the account through the normal app or website and tell a trusted adult.
Build recovery into the plan
Good account safety includes knowing what happens if access is lost. Recovery email addresses and phone numbers should be current, and children should know which adult can help them if an account is locked or compromised.
After a suspected compromise, changing the password is only one step. It may also be necessary to sign out other sessions, review recovery details and change the same password anywhere else it was reused.
A strong password habit is not 'make one impossible password'. It is: use unique passwords, protect sign-in codes, keep recovery options current and ask for help quickly when something changes.
Continue with the Cyber Safety Hub, practise the ideas in Ranger Academy, or use the free printable resources at home or in the classroom.