Teaching How to Read, Write, and Participate on the Web: Web Literacy for Educators

Password Scavenger Hunt

Made by Mozilla Learning Networks, Andrea Zellner, and the National Writing Project.

Learners will compete in a password scavenger hunt incorporating clues to strong and weak password-creation habits and then compare and contrast strong and weak passwords, learning privacy and security.

30 minutes

  • Preparation

    Read through the activity and prepare your clues and prizes for the scavenger hunt.

  • 5


    Weak passwords fall into predicatble patterns. They often use relatively few characters and are made up of just letters or just numbers in sequences that are easy for computers to crack. Examples of weak passwords include

    • Brand names.
    • Family members' names and birthdays.
    • Pets' names.
    • Products' names.
    • Song lyrics.
    • Sports teams.

    It's also a weak security practice to use the same username and password combination across multiple sites.

    What makes for a strong password? How can we develop more secure privacy and safety habits online? That's what this acticvity is all about! Let's go!

  • 15

    Password Scavenger Hunt

    Split each table into two teams of players: Team A and Team B. If you have a small group, split the entire group into those two teams.

    Explain the rules for your sacavenger hunt. Teams will use clues to try to figure out different passwords. Give each team its clues and explain how much time they have to find all the passwords they can. Try to make your teams and explain the rules in five minutes so that teams can use the rest of the time (ten minutes) to guess as many passwords as possible.

    All ten of Team A's clues should have the same answer. They will be using several different password-generation processes to find a single weak password that is connected to each clue. In the debrief, point out how this is like using the same username/password combination across multiple websites and services.

    All of Team B's ten clues should lead to different answers. Team B should have a more difficult time interpreting their clues and finding their password answers. Be ready to assure Team B that they are on the right track and that failure is okay - sometimes we want people to fail at guessing our passwords! In the debrief, explain that by using different combinations of logins and passwords, we make it much harder for others to get our information online.

    Example clues & answers:

    Team A

    • List all the whole numbers greater than 0, but less than 7 | 123456
    • 32 x 3858 | 123456
    • 192 x 643 | 123456
    • 96 x 1286 | 123456
    • 123449 + 7 | 123456
    • Google the most common password of 2014 | 123456

    Team B

    • Synonym for "cipher" | password
    • Left-hand letters above the home row | qwerty
    • America's pasttime | baseball
    • Smaug | dragon
    • Not to be confused with soccer | football
    • Not an ape, but a... | monkey

    Facilitate a brief discussion about the scavenger hunt. Ask what made it easy or difficult to figure out each password. Then congratulate all of your players and teams at the end of the hunt and give each player a little prize (like a sticker) for completing the activity.

  • 10

    Developing Strong Passwords

    Finally, invite participants to visit this strong password-creation page. Ask each learner to generate strong passwords using at least three of the strategies on that page, such as

    • Creating a passphrase.
    • Creating a diceware passphrase.
    • Creating a pronounceable password.
    • Creating a random password.
    • Creating a Basic 8 password.
    • Creating a Basic 16 password.

    Before moving on to the next activity, ask participants why having strong password habits and multiple password-creation strategies is important in their lives, online and off.