Cybersecurity for Students, An Animated Lesson

Lesson by Adnan, computer science lecturer  ·  aitrendblend editorial team  ·  Computer Science Education  ·  October 2026  ·  Reading time about 24 minutes

Cybersecurity for Students
An Animated Lesson

Who this lesson is for and how to use it

This is the fourth lesson in our Computer Science Education series. It builds on How a Computer Works, where students learned that everything is stored as bits, on How the Internet Works, where they cracked a Caesar cipher and saw why HTTPS matters, and on How AI Learns, which explained why chatbots can sound confident and still be wrong. Students who have done the internet lesson will find this one easier, but it also stands on its own.

The lesson suits grades nine to twelve and first year college students. Every lab runs entirely inside the browser. Nothing typed into this page is sent anywhere, and the page says so in the password lab, which is itself a lesson. Even so, teach students the habit of never typing a real password into any website that offers to test it.

Learning objectives

After three periods, a student should be able to do the following five things without notes.

1. Explain what makes a password hard to guess and estimate strength in bits.
2. Describe what a hash is, what the avalanche effect means, and why websites add salt.
3. Explain how a brute force attack works and why lockouts and length defeat it.
4. Identify at least four warning signs of a phishing message.
5. Explain how two factor login protects an account even after a password leaks.

What attackers actually do

Films show hackers typing furiously in dark rooms while green text scrolls past. Real attacks on ordinary people are far more boring and far more effective. Most of them fall into three groups. Attackers guess passwords, either by trying common ones or by trying everything. They steal databases of passwords from websites with weak protection and reuse whatever they find on other sites. And they simply ask, by sending messages designed to trick people into handing over passwords, codes or money.

Security professionals describe the goals of defence with three words, confidentiality, integrity and availability. Confidentiality means only the right people can read something. Integrity means nobody can change it without permission. Availability means it works when you need it. A stolen password breaks confidentiality, a hacked account posting scams breaks integrity, and ransomware that locks every file in a hospital breaks availability. Every lab in this lesson protects at least one of the three.

Passwords and the mathematics of guessing

Passwords on shared computers go back to 1961, when Fernando Corbató’s team at MIT gave each user of their time sharing system a private password so people could not read each other’s files. The idea has barely changed since. What has changed is the speed of the machines trying to guess them.

Strength is easiest to understand by counting. A password made of lowercase letters has 26 choices for every character. A password that also uses capitals, digits and symbols has roughly 95. The total number of possible passwords is the number of choices multiplied by itself once for every character. Security people describe that total in bits, the number of times you would have to double 1 to reach it.

Here \(L\) is the length and \(N\) is the number of possible characters. Every extra bit doubles the attacker’s work. Students usually notice two things straight away. Making a password longer adds bits much faster than adding a symbol does. And none of the formula matters if the password is one everybody else uses, because attackers start with lists of the most common choices.

Try the examples in order. The first two fall instantly because they sit near the top of every attacker’s list, and replacing letters with look alike symbols fools nobody, since attackers try those swaps automatically. The short random looking one survives only seconds against a fast attack. The four word phrase is easy to remember and much stronger, though the lab is honest about it. Counted letter by letter it looks enormous, but an attacker guessing whole words faces a smaller number, so four random words is a good start and six is better.

The two time columns show something students rarely hear. How long a password survives depends on the website as well as on you. A site that scrambles passwords with a deliberately slow method makes every guess thousands of times more expensive. The numbers are rough illustrations rather than promises, since attacker hardware keeps improving, but the comparison between rows stays true.

Brute force, trying everything

When the list of common passwords runs out, an attacker can try every possible combination in order. This is called a brute force attack, and it always succeeds eventually. The only question is whether eventually means seconds or the lifetime of the universe. Short PINs live in the first category, which is why phones and bank cards protect them in a completely different way, by limiting how many guesses anyone gets.

Without a lockout the attacker walks through every PIN and finds the secret within moments. Tick the lockout and run it again. After five wrong guesses the door closes, and the attacker has tried only a tiny fraction of the possibilities. This is the most important idea in the lab. A weak secret can still be safe if the system refuses to let anyone guess quickly, and a strong secret matters most in places where guessing cannot be limited, such as a stolen database that an attacker can test on their own computer as fast as their hardware allows.

Hashing, how websites keep a secret they never see

Here is a puzzle to pose to the class. When you log in, the website has to check your password. So it must store your password somewhere, right? Students almost always say yes. The surprising answer, for any well run service, is no. It stores a hash of your password instead.

A hash function takes any input, a word, a whole book or a film, and turns it into a fixed length fingerprint. The one used in Lab 2 is SHA-256, published by NIST in 2001, which always produces 256 bits, written as 64 hexadecimal characters. Three properties make it useful. The same input always gives the same hash. You cannot run it backwards to recover the input. And a tiny change to the input changes the hash completely, which is called the avalanche effect. At login the site hashes whatever you typed and compares the two fingerprints. If they match, you typed the right password, and the site never needed to keep the password itself.

The salt button shows why hashing alone is not quite enough. If two people choose the same password, their plain hashes are identical, so an attacker who cracks one has cracked both. Worse, attackers keep enormous precomputed tables of hashes for common passwords. The fix is salt, a random string stored next to each user’s hash and mixed in before hashing. Now every user’s hash is different, even for identical passwords, and precomputed tables become useless.

Professional systems go one step further. Instead of a fast hash like SHA-256, they use password hashing methods that are deliberately slow, such as bcrypt, introduced in 1999, or Argon2, which won an open international Password Hashing Competition in 2015. Slowing each guess from a billionth of a second to a fraction of a second barely affects a real user logging in once, but it cuts an attacker’s guessing speed enormously, which is exactly the difference between the two time columns in Lab 1.

Two factor login, a second lock on the door

Hashing protects passwords inside a website, but passwords still leak. People reuse them, sites get breached, and phishing pages collect them. Two factor authentication adds a second requirement that an attacker is unlikely to have. Security people group factors into three kinds, something you know such as a password, something you have such as your phone or a hardware key, and something you are such as a fingerprint.

The most common second factor is a six digit code from an authenticator app or a text message. Authenticator apps compute the code from a secret shared once with the website and the current time, so it changes every thirty seconds and is useless soon after. Text message codes are weaker, because criminals sometimes trick phone companies into moving a number to a new SIM card, but they are still far better than nothing. The single most important rule to teach is that nobody genuine will ever ask you to read a code out to them. A message asking for your code is an attack, every time.

Students can check whether an email address has appeared in a known data breach using Have I Been Pwned, a free service run by the security researcher Troy Hunt. Make sure students check their own addresses only, and treat a positive result as a reason to change that password and turn on two factor login, not a reason to panic.

The strongest password in the world is useless if you type it into the attacker’s website. That is why phishing works so well.From this lesson, period three

Phishing, attacking the human instead of the computer

Breaking strong encryption is practically impossible, and guessing a long unique password takes far too long. So attackers go around both by tricking a person into handing the secret over. The word phishing appeared in the mid 1990s among people stealing accounts on America Online, a play on fishing with a bait and waiting for someone to bite. The technique has not changed much. Only the bait has improved.

Phishing messages almost always lean on the same emotional levers. Urgency, your account closes in an hour. Fear, unusual sign in detected. Greed, you won a free phone. Curiosity, is this really you in this photo. And they nearly always end by asking for something a genuine sender never needs, a password, a one time code, a payment through a link, or an identity number. Students who learn to notice the feeling of being rushed are already halfway to safety.

The lab below shows six messages. All the companies, people and links are invented for practice, and every link uses a reserved example domain that cannot lead anywhere. Decide whether each one is safe or phishing, then read the red flags.

The trickiest examples are the ones where a familiar brand name appears inside the address. Browsers read web addresses from right to left when deciding which organization owns them. In northbank.example.secure-login.example, the part that counts is secure-login.example, and the words at the start are just decoration chosen by the attacker. For most addresses, teach students to find the last two parts of the name before the first single slash, and to be suspicious of any address that is a bare number, contains an at sign, or uses odd spelling such as a zero in place of a letter o.

A short history of attacks students should know

The history of computer security is a good way to show that threats grow along with technology. In November 1988 a Cornell graduate student named Robert Tappan Morris released a self copying program that spread across the young internet, slowing thousands of machines to a crawl. The Morris worm led to one of the first convictions under the United States computer fraud law and to the founding of the first computer emergency response team.

In May 2000 an email with the subject line ILOVEYOU arrived in millions of inboxes. Its attachment looked like a love letter and was actually a script that overwrote files and mailed itself to everyone in the victim’s address book. It succeeded because people trusted messages from people they knew, the same lever used by the hacked friend message in Lab 4.

In May 2017 the WannaCry ransomware spread around the world through a flaw in older versions of Windows, encrypting files and demanding payment. It hit businesses, governments and hospitals, including parts of the National Health Service in Britain. Microsoft had already released a fix for the flaw two months earlier, so the most powerful lesson for students is simple. Install updates.

Six habits that stop most attacks

All of the theory in this lesson turns into a short list of habits. Ask students to copy it into their notebooks in their own words and to pick one habit to start this week.

1. Use long, unique passwords. A phrase of several random words works well, and a different password for every important account stops one breach from unlocking everything.
2. Use a password manager. It remembers strong passwords so you do not have to, and it refuses to fill passwords into fake websites.
3. Turn on two factor login for email first, since email can reset every other account, then for social media and banking.
4. Never share a one time code with anyone, whatever they claim to be.
5. Slow down when a message rushes you. Open the app or type the website yourself instead of clicking the link.
6. Install updates on phones, computers and apps, because most fixes close holes attackers already know about.

Misconceptions students bring to class

• Nobody would bother hacking me. Most attacks are automated and aim at millions of accounts at once. Being ordinary does not make you invisible.
• Symbols make any password strong. P@ssw0rd is on every attacker’s list. Length and uniqueness beat clever substitutions.
• The padlock means a website is safe. It only means the connection is encrypted. A phishing site can have a padlock too.
• Incognito mode protects me from hackers. It only stops your browser saving history on that device.
• Antivirus software is enough. It helps, but no software can stop you typing your password into a fake page.

Where this lesson simplifies the truth

Every lab here is a teaching model. The password meter uses a simple counting formula and a short list of common passwords, while real strength checkers use much larger breach lists and pattern detection, and real attackers combine dictionaries, rules and personal information. The crack times assume fixed guessing speeds chosen to illustrate the difference between fast and slow hashing, and actual speeds depend on hardware and the exact method a website uses.

The hashing lab uses SHA-256 because it is famous and easy to demonstrate, but SHA-256 on its own is not suitable for storing passwords, which is exactly why bcrypt and Argon2 exist. The phishing lab shows six clear cases, while real phishing can be far more convincing, sometimes using a person’s name, school or recent purchases. None of this weakens the central message. Students who understand why each defence works will adapt as attacks change.

Bringing it all together

The main achievement of this lesson is turning a list of rules that students usually ignore into ideas they can reason about. A password is strong when the number of possible guesses is enormous. A website protects that password by storing only a salted, slow hash. Lockouts and two factor login protect accounts even when a secret is weak or stolen. And because the technology is hard to break, attackers target people instead, with messages built to make them hurry.

The conceptual shift is from security as fear to security as understanding. A student who knows how brute force works does not need to be told to choose a long password. A student who knows how a domain name is read can spot a fake link without a checklist. Understanding lasts longer than rules, because it still works when the attack is one nobody has seen before.

These ideas connect to every other lesson in the series. Hashes are made of the same bits and logic gates from How a Computer Works. HTTPS and DNS from How the Internet Works decide whether a connection can be trusted. And the AI lesson matters too, since criminals now use chatbots to write more convincing phishing messages, while defenders use machine learning to filter them. Students heading toward careers in this field will find more advanced reading in our cybersecurity section.

The lesson has honest limits. It does not cover malware analysis, network attacks, the mathematics behind modern encryption or the legal side of computer crime. Teachers with older classes can extend period two into public key cryptography, and teachers without computers can run the phishing workshop entirely on paper and act out a brute force attack with a combination lock.

A natural next lesson is privacy, covering what apps collect about students, how data is shared and what rights people have over their information. For now, a class that started by laughing at movie hackers can explain how real attacks work and, more usefully, how to stop them.

Companion Python code for the classroom

The program below rebuilds the main labs in plain Python with no extra libraries. It estimates password strength in bits, including an honest estimate for passphrases, hashes text with SHA-256 and counts how many characters change, stores and checks a salted password, brute forces a PIN with and without a lockout, and checks web addresses for common phishing red flags. It runs in any Python 3 setup.

# Cybersecurity for Students, companion code for the aitrendblend lesson
# Runs on any Python 3 installation. No extra libraries needed.
import hashlib
import math
import os
from urllib.parse import urlparse

# Part 1. Password strength as entropy
COMMON = {"123456", "password", "qwerty", "111111", "iloveyou", "admin", "pakistan", "football", "abc123"}


def charset_size(pw):
    size = 0
    if any(c.islower() for c in pw): size += 26
    if any(c.isupper() for c in pw): size += 26
    if any(c.isdigit() for c in pw): size += 10
    if any(not c.isalnum() for c in pw): size += 33
    return size


def entropy_bits(pw):
    """Upper bound on guessing difficulty: length x log2(alphabet size)."""
    if pw.lower() in COMMON:
        return 0.0                      # attackers try these first
    return len(pw) * math.log2(charset_size(pw)) if pw else 0.0


def crack_time(bits, guesses_per_second=1e10):
    """Average time to guess, assuming an offline attacker at the given speed."""
    seconds = (2 ** bits) / 2 / guesses_per_second
    if seconds > 31_557_600 * 1e12:
        return "more than a trillion years"
    for unit, size in [("years", 31_557_600), ("days", 86_400), ("hours", 3_600), ("minutes", 60)]:
        if seconds >= size:
            return f"{seconds / size:,.0f} {unit}"
    return f"{seconds:.3f} seconds"


def passphrase_bits(n_words, list_size=7776):
    """Realistic strength of n words picked at random from a word list (Diceware has 7776)."""
    return n_words * math.log2(list_size)


# Part 2. Hashing, how websites store passwords without storing passwords
def sha256(text):
    return hashlib.sha256(text.encode()).hexdigest()


def store_password(pw):
    salt = os.urandom(16).hex()                       # random per user
    return salt, sha256(salt + pw)


def check_password(attempt, salt, stored_hash):
    return sha256(salt + attempt) == stored_hash


def changed_hex_digits(a, b):
    return sum(x != y for x, y in zip(a, b))


# Part 3. Brute force, and why lockouts matter
def brute_force_pin(secret, digits=4, lockout_after=None):
    for guess in range(10 ** digits):
        if lockout_after is not None and guess >= lockout_after:
            return None, guess                        # locked out, attacker stopped
        if f"{guess:0{digits}d}" == secret:
            return guess, guess + 1
    return None, 10 ** digits


# Part 4. A very simple phishing link checker (real filters are far smarter)
TRUSTED = {"northbank.example", "schoolportal.example"}


def red_flags(url):
    flags = []
    parsed = urlparse(url)
    host = parsed.hostname or ""
    if parsed.scheme != "https":
        flags.append("not HTTPS")
    if any(ch.isdigit() for ch in host.replace(".", "")) and host.replace(".", "").isdigit():
        flags.append("raw IP address instead of a name")
    registered = ".".join(host.split(".")[-2:])
    if registered not in TRUSTED and any(t.split(".")[0] in host for t in TRUSTED):
        flags.append(f"brand name inside a different domain ({registered})")
    if "@" in url:
        flags.append("@ sign hides the real destination")
    return flags


# Smoke test
if __name__ == "__main__":
    for pw in ["pakistan", "Tiger7", "correct horse battery staple"]:
        bits = entropy_bits(pw)
        print(f"{pw!r:34} {bits:6.1f} bits  ~{crack_time(bits)}")
    for n in (4, 6):
        pb = passphrase_bits(n)
        print(f"{n} random Diceware words, counted honestly: {pb:.1f} bits  ~{crack_time(pb)}")

    a, b = sha256("hello"), sha256("hellp")
    print("\nSHA-256('hello') =", a)
    print("SHA-256('hellp') =", b)
    print("Hex digits that changed:", changed_hex_digits(a, b), "of 64")

    salt, h = store_password("MySecret123")
    print("\nStored salt and hash:", salt[:12] + "...", h[:16] + "...")
    print("Right password accepted:", check_password("MySecret123", salt, h))
    print("Wrong password accepted:", check_password("mysecret123", salt, h))

    found, tries = brute_force_pin("7351")
    print("\nPIN found after", tries, "guesses without a lockout")
    found2, tries2 = brute_force_pin("7351", lockout_after=5)
    print("With a 5 try lockout the attacker stops after", tries2, "guesses, found =", found2)

    for url in ["https://northbank.example/login",
                "http://northbank.example.account-verify.example/login",
                "https://192.0.2.44/northbank"]:
        print(f"\n{url}\n  red flags: {red_flags(url) or 'none'}")

    assert entropy_bits("pakistan") == 0
    assert changed_hex_digits(a, b) > 40
    assert check_password("MySecret123", salt, h) and not check_password("mysecret123", salt, h)
    assert found2 is None and tries2 == 5
    assert red_flags("https://northbank.example/login") == []
    print("\nAll checks passed.")

When you run it, the common password should score zero bits, almost every hex character should change between the two hashes, the right password should be accepted and the wrong one rejected, the lockout should stop the attacker after five guesses, and the final line should report that all checks passed. A good extension task is to make the phishing checker spot letter swaps, such as a zero in place of the letter o in a brand name.

Check your understanding

Six questions cover the whole lesson. Choose an answer for each and press Check answers to see which were right, with a short explanation for each.

Frequently asked questions

Related reading on aitrendblend