By: Sneh, Trevor, Dilraj
Overview
Every time you create an account online, your password goes through a series of invisible protections, or at least, it should. This learning resource explores what actually happens to passwords after you hit submit, why poor implementation leads to massive data breaches, and what both developers and everyday users can do about it.
As Bonneau et al. (2012) highlight, most authentication systems carry serious problems that users never see, and further found that weak password storage remains one of the leading causes of large-scale data breaches globally. This resource makes those technical realities approachable for anyone.
Learning Context and Learners
Who this is for: 15–20 learners across Canada, ranging from high school students (16+) to working professionals (up to 35). No programming or cybersecurity background is assumed, just basic internet use.
Lifestyle considerations: Some learners may be working full-time or managing family responsibilities. The module is fully asynchronous and completable in flexible 1–2 hour sessions with no live attendance required.
Accessibility: Content is written in plain language throughout, uses accessible color palettes for color blindness, and is broken into short, focused chunks to support learners with ADHD or English as an additional language.
Learning Theory: Constructivism
This resource is grounded in constructivism, the idea that learners build understanding through active experience rather than passive reception. Rather than simply explaining what hashing is, learners generate their own hashes, attempt to crack passwords, and analyze real breach scenarios.
This fits the topic well because password security only becomes meaningful when you feel it. Seeing a weak password crack in two seconds on CrackStation is more impactful than reading about it. Each subtopic moves from concept to interactive activity, so learners construct real understanding they can apply.
Learning Design: Inquiry-Based Learning
We use an inquiry-based design structured around essential questions. Each subtopic opens with a question that doesn’t have an obvious answer, pushing learners to explore before they’re given explanations.
This works here because the topic has natural curiosity hooks; most people are genuinely surprised that websites can’t retrieve their passwords, or that two people using the same password get different hashes. Inquiry lets that surprise do the teaching.
Designing for Diverse Learners (UDL + CAST)
Following Universal Design for Learning principles:
Multiple means of representation: Concepts are presented through written explanations, embedded YouTube videos, and interactive tool exploration so learners can engage in the format that works for them.
Multiple means of engagement: Activities range from low-stakes exploration (MD5 generator) to reflective writing to applied checklist creation. Learners choose how deeply to engage with each tool.
Multiple means of expression: Assessments include short-answer quizzes, plain-language written explanations, and a personal security checklist, giving learners multiple ways to demonstrate understanding.
Technology Rationale
WordPress hosts the resource because it’s free, mobile-friendly, and requires no software installation, which removes access barriers for learners across Canada.
H5P enables interactive quizzes embedded directly in the page so learners get immediate feedback without leaving the resource.
WordPress quizzes handle written submissions easily and work on any device.
MD5HashGenerator.com, CrackStation.net, and HaveIBeenPwned.com are free, browser-based tools that make abstract concepts easy with zero setup required.
Learning Objectives
By the end of this resource, learners will be able to:
- Explain the concept of hashing, describe the step-by-step process of password storage, and identify why plain-text storage is dangerous.
- Describe what salting is, explain how it prevents rainbow table attacks, and demonstrate why two identical passwords produce different hashes when salted.
- Identify at least three common password attack methods, explain how each works, and connect attack success to poor storage practices.
Part 1: What Is Hashing and How Does It Work?
Essential Question: In what ways does the journey of a password from input to storage reveal the hidden complexity of everyday digital security?
Content
When you create an account, your password is run through a hash function, which is a one-way mathematical process that converts it into a fixed string of characters called a hash. “hello123” might become 482c811da5d5b4bc6d497ffa98491e38. The original password is never stored.
Key properties of hashing:
- The same input always produces the same hash
- Changing even one character completely changes the output
- The process cannot be reversed because hashing is one-way
- All hashes are the same fixed length regardless of input size
When you log in, your input is hashed and compared to the stored hash. If they match, you’re in. This is why secure websites force password resets rather than emailing you your password, because they genuinely cannot retrieve it.
Watch
Learning Activity 1: Hash It Yourself (Explore)
Go to
https://www.md5hashgenerator.com
Try the following:
- Type in a short word like “hello” and generate its hash
- Type in the same word with one character changed. Notice anything?
- Try a very long sentence, and what do you notice about the hash length?
- Try to reverse a hash back to the original text
Reflection questions to answer before moving on:
- What stays consistent about hashes regardless of input?
- Why does even a tiny change produce a completely different hash?
- What does this tell you about why hashing is used for security?
Assessment 1: Short-Answer Quiz (H5P)
Four questions testing definitions and key properties of hashing.
Part 2: What Is Salting and Why Is It Necessary?
Essential Question: How does adding randomness to the hashing process fundamentally change the effectiveness of password protection?
Content
Hashing alone has a serious weakness. Attackers use rainbow tables, which are massive precomputed databases of common passwords and their hashes. If your password is “password123” and the hash is always the same, matching it takes seconds.
Salting fixes this. Before hashing, the system adds a unique random string (the salt) to your password. So even if you and a friend both use “password123,” your stored hashes look completely different. Rainbow tables become useless because the salt is unique per user.
Key points:
- Salts are randomly generated and stored alongside the hash
- The same password produces a different hash for every user
- Modern algorithms like bcrypt handle salting automatically
- MD5 and SHA-1 are outdated and should never be used for passwords
Watch:
Learning Activity 2: Crack the Hash Challenge (Experiment)
Go to
and paste in these pre-hashed passwords one at a time:
5f4dcc3b5aa765d61d8327deb882cf99
e10adc3949ba59abbe56e057f20f883e
d8578edf8458ce06fbc5bb76a58c5ca4
Record: Did it crack? How fast? Then try hashing your own weak password on MD5HashGenerator and pasting that hash into CrackStation.
Reflection: Why did some crack instantly? What does this tell you about the limits of hashing without salting?
Assessment 2: Plain-Language Explanation (Google Form)
Write 100–150 words explaining salting as if you’re teaching a friend with zero technical background. Focus on: what salting is, why it matters, and what happens during a rainbow table attack.
Part 3: Common Password Attacks and Best Practices
Essential Question: What do data breaches reveal about the shared responsibility between developers and everyday users, and how can we apply best practices?
Content
Even with hashing and salting, poor implementation leaves users exposed. The three most common attack types:
Brute force — automated tools try every possible character combination until one works. Short or simple passwords fall fast.
Dictionary attacks — attackers run through lists of common words and passwords. “iloveyou” or “qwerty” are cracked almost instantly.
Rainbow table attacks — precomputed hash databases matched against stolen data. Defeated by proper salting, but still dangerous when developers skip it.
The root problem, as Bonneau et al. (2012) argue, is that many systems continue to use outdated algorithms such as MD5 without salting, leaving users exposed even when a breach occurs. NIST (2017) guidelines specifically recommend modern adaptive algorithms like bcrypt or Argon2.
What good looks like vs. bad:
| Company A (Secure) | Company B (Insecure) |
|---|---|
| Uses bcrypt with unique salts | Uses MD5 with no salting |
| Breach exposes uncrackable hashes | Breach exposes millions of passwords within hours |
| Forces password reset after breach | Emails users their actual passwords |
Learning Activity 3: Good Company vs. Bad Company (Analyze and Apply)
Read the two case studies above. Then:
- Go to HaveIBeenPwned.com and check your email address
- If you show up in a breach, look at which company was responsible and when
Use what you’ve learned to build your Personal Password Security Checklist.
Assessment 3: Personal Security Checklist (WordPress Form)
Create a checklist of at least 3 concrete security habits covering both your own behavior and what to look for in services you trust. Examples to get you started, but write your own:
- Enable two-factor authentication on all major accounts
- Use a password manager rather than reusing passwords
- Only trust services that force resets instead of emailing passwords
- Check HaveIBeenPwned regularly
Submitted via WordPress form. Graded on a proficiency scale: Developing / Proficient / Extending based on depth and specificity of items.
Bibliography
Bonneau, J., Herley, C., Van Oorschot, P. C., & Stajano, F. (2012). The quest to replace passwords: A framework for comparative evaluation of web authentication schemes. 2012 IEEE Symposium on Security and Privacy.
National Institute of Standards and Technology. (2017). Digital identity guidelines: Authentication and lifecycle management (NIST Special Publication 800-63B). https://pages.nist.gov/800-63-3/