Weak passwords

A password that is short, common, or predictable, making it easy for attackers to guess or crack.

Part of: VCE Applied Computing - U2O2 - Cyber Security — Module 36, 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 59, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 34, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 40, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 21, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 101, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 35, WA Computer Science ATAR Year 11 — Cyber Security — Module 106

Understanding Weak passwords in VCE Cyber Security

What it does: This code generates a secure, random password rather than a predictable one. This code sets a length requirement that helps resist guessing attacks. Extremely common passwords are among the first attackers try. Randomness and mixed characters make a password far harder to crack. Personal details are often easy for attackers to find or guess. Dictionary words are quickly checked by automated cracking tools. Attackers already account for simple number additions in cracking tools. Longer, more random passwords take exponentially longer to crack.

Common mistakes: Line 1 uses the word "password" itself, one of the most common weak passwords. Line 2 sets the minimum required length to 4, far too short to be secure.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Weak passwords to a class →

This module's key terms are also in a printable crossword (Modules 31–40) and word search (Modules 21–40).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Using a short, common password like '123456' is considered weak.

TrueFalse

Matches

password = username

↓

The mistake: setting the password equal to the username

Applying

Meanings

Term

Weak password

Meaning

A password that is short, common, or predictable, making it easy for attackers to guess or crack.

Practice

password = "password123"

Testing

Gaps

= "123456"

Check Answer

Spots

1password = "password"

2hashed = hash(password)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Using a short, common password like '123456' is considered weak.

A. True ✓

B. False

Extremely common passwords are among the first attackers try.

2. Which is a stronger password: 'Tr7$mQ9!zL' or 'password1'?

A. Tr7$mQ9!zL ✓

B. password1

Randomness and mixed characters make a password far harder to crack.

3. Reusing your pet's name as a password makes it hard to guess.

A. True

B. False ✓

Personal details are often easy for attackers to find or guess.

4. Which is more secure: a long random password, or a short dictionary word?

A. Long random password ✓

B. Short dictionary word

Dictionary words are quickly checked by automated cracking tools.

5. Adding a single number to the end of a common word, like 'password1', makes a password strong.

A. True

B. False ✓

Attackers already account for simple number additions in cracking tools.

Match the Pairs

password = "123456" → An example of a weak, easily guessable password

password = "qwerty" → A common weak password based on a keyboard pattern

A strong password uses length, randomness and mixed characters → password = generate_secure()

Enforcing a minimum password length improves security → min_length = 12

password = username → The mistake: setting the password equal to the username

password = birthdate → The mistake: using a predictable personal detail as the password

Key Term

Weak password

A password that is short, common, or predictable, making it easy for attackers to guess or crack.

Fill in the Blanks

1. password = "123456"

Hint: Type the name of the variable storing the password value.

2. min_length = 8

Hint: Type the name of the variable storing the minimum allowed length.

3. if len(password) < min_length:

Hint: Type the function name that returns the number of characters in the password.

4. def check_strength():

Hint: Type the name of the function that checks password strength.

5. is_weak = True

Hint: Type the name of the variable that flags whether the password is weak.

Spot the Error

Question 1

A password = "password"

B hashed = hash(password)

C store(hashed)

Line A — Line 1 uses the word "password" itself, one of the most common weak passwords.

Question 2

A password = get_input()

B min_length = 4

C check_length(password)

Line B — Line 2 sets the minimum required length to 4, far too short to be secure.

Question 3

A password = generate_secure()

B hashed = hash(password)

C password = "qwerty"

Line C — Line 3 overwrites the secure password with the common, predictable "qwerty".

Question 4

A username = "admin"

B password = get_input()

C check_complexity(password)

D password = username

Line D — Line 4 sets the password equal to the username, making it trivially guessable.

Question 5

A password = get_input()

B min_length = 8

C require_numbers = True

D require_symbols = True

E skip_complexity_check = True

Line E — Line 5 skips the complexity check, undoing the earlier security requirements.

Student with a class code? Join your class →