Password Game — Watch a Computer Guess Yours, Then Beat It

Children remember a demonstration and forget a rule. Type something in and watch the estimate move; then try a passphrase and watch it move a great deal further.

Telling a child to use a strong password produces a nod and no change. Showing them that a machine reaches their favourite word in under a second, and then showing them four ordinary words that would take longer than anyone will ever try, produces a different result, because the second one is a thing they can do immediately.

Try it

Type something like a password (not your real one)

How the estimate works

It counts how many characters are possible in each position (lower case, upper case, digits, punctuation) and raises that to the length, which gives the number of combinations. Half of them is the average number of guesses needed, and dividing by a hundred billion guesses a second gives the time.

That rate is deliberately pessimistic on your behalf: it assumes an attacker who has stolen a database and is guessing offline with serious hardware instead of typing into a login form. Against a login form nearly anything survives, because the site locks the account. Against a stolen database, only the maths protects you.

Why length alone does not save you

The estimate assumes a machine guessing blindly. Real attacks do not start blind. They start with lists of every password that has ever appeared in a breach, plus the obvious mutations: a capital at the front, a number at the end, an exclamation mark after that.

So a long password built around a common word is tried in the first seconds regardless of how long it is. That is why the tool refuses to give a time for anything containing a word from those lists: the number would be reassuring and wrong.

Building one that holds

Four or five unrelated ordinary words, with spaces, in an order that means nothing to anyone else. Long enough that the maths defeats blind guessing, and not built from anything a list contains. It is also far easier to type on a games console than a string of symbols, which matters more than it sounds: an unusable password gets written on a sticky note.

What to avoid: a name in the family, a pet, a birthday, a football team, the site’s own name, and any single dictionary word however obscure it feels. Those are the first things tried because they are the first things chosen.

The part that matters more than strength

One strong password used everywhere is worse than several mediocre ones used once each, because a single breach then opens everything. Reuse, not weakness, is what turns one leaked database into five compromised accounts.

Which points at a password manager, including the one already built into the browser or the phone. It removes the need to remember anything, and it has a quieter benefit: it will not fill your credentials into a look-alike domain, so it notices a phishing page before you do. That behaviour catches a large share of the attempts described on the phishing page.

The rule that goes with it is on the ten house rules: passwords are family secrets, not friendship tests. Sharing one to prove trust is how accounts get lost, and a shared family manager is how they do not.

Teaching it to a child who does not care yet

The reason password advice fails with children is that the threat is abstract and the inconvenience is immediate. The demonstration inverts that: the inconvenience becomes a game and the threat becomes visible, which is the only version of this that has ever held anyone’s attention.

What works after the demonstration is a single concrete task rather than a policy. Pick one account together, the game account they care most about, and change it to a passphrase there and then. One account changed properly teaches more than six changed under protest, and it gives them something to compare the others against.

The other half is the rule about not sharing, and it is worth saying why rather than just stating it. Sharing a password is normally an act of friendship, not carelessness, which is precisely why telling a child it is forbidden does not work. Explaining that friendships change, and that a shared family manager exists so nobody has to be trusted with anything, gives them somewhere to put the impulse.

Questions about passwords

Is it safe to type a password in here?

Nothing is transmitted: the estimate is calculated in your browser and the field is never read by anything else. That said, the sensible habit is to type something like your password, never the real one, and that habit is worth keeping on every site that offers a checker like this.

Why does my long password score badly?

Because it contains a word from a guessing list. Attackers try the lists and their obvious variations first, so a common word with a number after it is tried within seconds regardless of length.

Are the times accurate?

They are an order-of-magnitude estimate against a hundred billion guesses a second, which is roughly what a well-resourced attacker manages offline. Treat the difference between “minutes” and “centuries” as the useful information, not the exact figure.

Do I still need to change passwords regularly?

Not on a schedule, which mostly produced predictable variations. Change one when a service is breached, when you have reused it somewhere, or when you have any reason to think it is known.

What about the security questions?

Treat them as extra passwords, not as facts. A mother’s maiden name or a first school is frequently discoverable, so answer with something unrelated and store the answer with the password.

Which account should I protect first?

Email, without much competition. It is the reset route for everything else, which means a strong password and two-factor authentication there protects accounts you have forgotten you own.