Password Security Training for Employees

Your path

10 steps · 2 quizzes · about 55 minutes · open any step, or read it here

1. 1
   Password security training: keep attackers out of your accountsStart hereIn this password security training you learn how attackers get into accounts and the few habits that keep them out: long passphrases, one password per account, a password manager and two-step sign-in.InteractiveHands-on · 4 min

   Read this step

   In this password security training you learn how attackers get into accounts and the few habits that keep them out: long passphrases, one password per account, a password manager and two-step sign-in. You try each idea with made-up passwords before it is explained.

   Most break-ins don't need clever hacking. Breach reports such as Verizon's yearly Data Breach Investigations Report list stolen credentials, a user name and its password, among the most common ways attackers get in.

   Try it: press Start guessing and watch which password falls first.

   Interactive · Two passwords, one attacker — try it in the lesson

   In this lesson you'll:

   • see the four ways passwords are really stolen, and what stops each one
   • measure how long a password takes to crack, and why length beats symbols
   • make a passphrase, and let a password manager handle the rest
   • pick the second sign-in step that stops the most attacks, and know what to do when a password leaks

   It takes about 55 minutes, with a quiz in the middle, a practice round and a final quiz.

   Takeaway: a password that follows a pattern falls fast, however complex it looks.

2. 2
   How passwords get stolen: four ways inAttackers rarely guess your password by thinking about you. They use four methods that work on thousands of people at once: Breach and reuse. A site you used is breached, and its list of emails and passwords is sold. Bots try each pair on other sites.InteractiveHands-on · 4 min

   Read this step

   Attackers rarely guess your password by thinking about you. They use four methods that work on thousands of people at once:

   1. Breach and reuse. A site you used is breached, and its list of emails and passwords is sold. Bots try each pair on other sites. This is called credential stuffing.
   2. Phishing. A fake sign-in page collects what you type.
   3. Guessing. A few common passwords are tried on many accounts, slowly enough not to lock any of them. This is called password spraying.
   4. Cracking a stolen list. Sites store passwords scrambled (hashed). If the list is stolen, the attacker guesses offline, with no limit on tries.

   Try it: press each way in and watch where the password travels.

   Interactive · Four ways a password is stolen — try it in the lesson

   Notice that in the first two, the strength of the password doesn't matter at all: the attacker gets it whole. That is why the rest of this lesson is about more than strength.

   Takeaway: a strong password stops guessing and cracking; a unique one stops reuse; a second step stops most of the rest.

3. 3
   Length beats complexity: how long a password takes to crackWhen an attacker has a stolen list of scrambled passwords, they can try every combination.InteractiveHands-on · 4 min

   Read this step

   When an attacker has a stolen list of scrambled passwords, they can try every combination. The number of combinations is the number of possible characters, multiplied by itself once for every character:

   $$\text{combinations} = (\text{characters to choose from})^{\text{length}}$$

   Adding symbols makes the first number bigger. Adding characters makes the power bigger, and powers grow much faster. Eight characters from the whole keyboard (95 choices) give about 6.6 quadrillion combinations. Fifteen lowercase letters give about 1.7 sextillion, roughly 250,000 times as many.

   Speed matters too. A login page can slow guesses to a handful a second. A stolen list scrambled with a slow method (such as bcrypt) allows thousands a second. One scrambled with a fast method can be guessed tens to hundreds of billions of times a second on graphics cards. The block uses 100 billion as an illustration of that worst case.

   Try it: set 8 characters with all four sets on and note the time. Then turn off everything but lowercase and slide the length up until the time is longer.

   Interactive · Cracking-time simulator — try it in the lesson

   What length of lowercase letters beats 8 characters of everything?

   Takeaway: each extra character multiplies the work; 15 or more characters is a good target.

4. 4
   Why P@ssw0rd1 is weak: attackers guess like peopleThe simulator assumed every character was picked at random. People don't pick at random, and attackers know it.InteractiveHands-on · 4 min

   Read this step

   The simulator assumed every character was picked at random. People don't pick at random, and attackers know it. Their cracking tools don't start at aaaaaaaa: they start with lists of leaked passwords, dictionaries and names, then apply rules that copy what people do:

   • a capital at the start, and a number or year and a symbol at the end (Summer2026!)
   • look-alike swaps: @ for a, 0 for o, 1 for i, $ for s (P@ssw0rd)
   • the company's name, the season, the month, a pet's name, a football team
   • rows of keys (qwerty, 1qaz) and counting (123456)

   A password built that way is guessed in seconds, even at 12 or 14 characters.

   Try it: pick each example, then type a few made-up passwords of your own. Never type a real password into a page like this one.

   Interactive · Run the attacker's rules — try it in the lesson

   Why did "correct horse battery staple" fall, even though it's four words?

   Takeaway: a password is strong when it is long and has no pattern a person would follow.

5. 5
   Passphrases: random words you can rememberA passphrase is several words picked at random, such as velvet orbit pepper glacier trumpet. It is long, so it's strong, and it is made of words, so it's easy to type and remember. The words must be picked by chance, not chosen.InteractiveHands-on · 4 min

   Read this step

   A passphrase is several words picked at random, such as velvet orbit pepper glacier trumpet. It is long, so it's strong, and it is made of words, so it's easy to type and remember.

   The words must be picked by chance, not chosen. The classic method, called Diceware, rolls five dice for each word and looks the roll up in a list of 7,776 words (6 × 6 × 6 × 6 × 6 = 7,776). Each word multiplies the combinations by 7,776:

   Words	Combinations	Time to try all at 100 billion a second
   3	470 billion	about 5 seconds
   4	3.7 quadrillion	about 10 hours
   5	28 quintillion	about 9 years
   6	221 sextillion	about 70,000 years

   Four words is fine for an account that also has a second sign-in step, because no one can guess online that fast. For a password that protects everything else, such as your password manager or your computer sign-in, use five or more. A password manager's generator can make passphrases for you.

   Try it: roll a few passphrases, then change the number of words and watch the time.

   Interactive · Roll a passphrase — try it in the lesson

   Takeaway: five or more random words: long enough to be strong, easy enough to type.

6. Check: strength, patterns and passphrasesFour questions on what you've seen so far.Quiz · 4 questions

   Read the questions

   Four questions on what you've seen so far.

   Question 1. Which change makes a password hardest to crack?

   • Swapping the letter a for @
   • Adding a symbol to the end
   • Making it several characters longer
   • Adding a capital letter at the start

   Question 2. Why is Larkfield2026! a weak password at Larkfield?

   • It is too short to be allowed
   • It follows a common pattern: company name, year, symbol
   • It has no lowercase letters
   • Symbols make passwords weaker

   Question 3. What makes a passphrase strong?

   • Words you chose because they mean something to you
   • A famous quote or song lyric
   • Several words picked at random
   • One long word with numbers in it

   Question 4. Your password was in a site's breach. Why does that put your other accounts at risk?

   • Breaches spread to every site you use
   • If you used the same password elsewhere, bots will try it there
   • Attackers can now crack any password you have
   • It doesn't, if the password was strong
7. 6
   One password per accountA strong password protects you from guessing and cracking. It doesn't protect you when it leaks whole, from a breached site or a fake sign-in page. Then it opens every account that uses it. You can't stop other sites from being breached.InteractiveHands-on · 4 min

   Read this step

   A strong password protects you from guessing and cracking. It doesn't protect you when it leaks whole, from a breached site or a fake sign-in page. Then it opens every account that uses it.

   You can't stop other sites from being breached. You can make sure that a password leaked from one of them opens nothing else: give every account its own password. Your work password, above all, should never be used anywhere else.

   Try it: run the bot with Dana's same password everywhere. Then turn on the VPN's second step and run it again. Then turn off the shared password.

   Interactive · One leaked password, four accounts — try it in the lesson

   Takeaway: one account, one password: a leak then stays where it started.

8. 7
   A password manager: the habit that makes the others possibleNo one can remember dozens of long, unique passwords. A password manager remembers them for you. It is an app, or part of your browser, that keeps your passwords in an encrypted vault, locked by one strong passphrase you do remember.InteractiveHands-on · 4 min

   Read this step

   No one can remember dozens of long, unique passwords. A password manager remembers them for you. It is an app, or part of your browser, that keeps your passwords in an encrypted vault, locked by one strong passphrase you do remember.

   It does three things for you:

   1. Generates a long random password for each new account.
   2. Fills it in when you sign in, so you never type or see it.
   3. Reads the address. It offers to fill only on the site the password was saved for, so a look-alike page gets nothing. That makes it a defence against phishing too.

   Try it: open pages A, B and C. On which ones does the manager offer to fill in Dana's password?

   Interactive · What a password manager sees — try it in the lesson

   When the manager doesn't offer to fill on a page that should be familiar, don't copy the password across by hand. Stop and read the address.

   Use the password manager your company provides for work accounts, and follow its rules for what goes in it. Protect the manager itself with a passphrase of five or more random words and two-step sign-in.

   Takeaway: remember one passphrase; let the manager make, keep and fill the rest.

9. 8
   Two-step sign-in: a password is no longer enoughTwo-step sign-in (also called multi-factor authentication, or MFA) asks for something more than the password: a code, an approval on your phone, a security key or a passkey. A stolen password alone then gets the attacker nowhere.InteractiveHands-on · 5 min

   Read this step

   Two-step sign-in (also called multi-factor authentication, or MFA) asks for something more than the password: a code, an approval on your phone, a security key or a passkey. A stolen password alone then gets the attacker nowhere.

   Second steps are not all equal:

   • A code by text message is much better than nothing, but texts can be redirected when an attacker takes over your phone number (a SIM swap).
   • A code from an authenticator app can't be redirected, but you can still be tricked into typing it on a fake page.
   • Approve on the phone is easy, which is the danger: attackers send request after request until someone taps Approve to make them stop. Typing a number shown on the sign-in screen fixes that.
   • A security key or a passkey checks the site's real address before it answers, so it can't be used on a fake page. These are called phishing-resistant.

   A passkey replaces the password altogether: your phone or computer keeps a secret key for each site and proves it holds it after you confirm with your fingerprint, face or screen PIN. There is nothing to type, so nothing to leak or reuse.

   Try it: the attacker already has Dana's password. Pick each second step and see which attacks still get in.

   Interactive · Which second step stops which attack — try it in the lesson

   Whatever second step you use: never approve a request you didn't start, and never read a code out to anyone. Your IT team will never ask for it.

   Takeaway: turn on a second step everywhere it's offered; use a passkey or a security key where you can.

10. 9
    When a password leaks: what to do, and what not toLeaks happen to careful people too. What matters is the next hour. The rules are short: Change it from the real site, opened from your bookmark or by typing the address, never from a link in a warning email.InteractiveHands-on · 4 min

    Read this step

    Leaks happen to careful people too. What matters is the next hour. The rules are short:

    • Change it from the real site, opened from your bookmark or by typing the address, never from a link in a warning email.
    • Change it everywhere you used it, each to a new, different password.
    • Tell IT or security at once if it's a work password, or you typed it on a page you don't trust. They can end the attacker's sessions and check the account.
    • Never share a password, even with a colleague or your manager. Ask for access of their own instead.
    • Change passwords when there's a reason, not on a calendar. Forced regular changes lead to weaker passwords (Spring2026!, then Summer2026!). Current NIST guidance tells organisations not to require them; follow your company's own policy.

    Try it: decide each situation before you see the answer.

    Interactive · What would you do? — try it in the lesson

    Takeaway: change it from the real site, change it wherever you reused it, and tell IT.