Staying safe online: strong passwords, 2FA and phishing
Build strong passwords, turn on two-factor authentication and spot phishing messages, and know what to do if you click a bad link.
KS3GCSEMiddle SchoolHigh SchoolCurriculum fit: KS3 and GCSE Computing (the National Curriculum includes using technology safely, respectfully and responsibly). US: no US standards source is linked here: check your school's digital citizenship guidance.
On this page
What is it?
Staying safe online means protecting your accounts, your personal information and yourself from harm. Many attacks do not break technology. They trick people into handing over information or access.
Three habits help most: strong, unique passwords with two-factor authentication, careful handling of messages and links, and thinking before sharing personal information.
Key formulas and ideas
- Password: long and unique, such as a passphrase of several unrelated words. A password manager can store them.
- Two-factor authentication (2FA): a second proof of identity, such as a code from an app, in addition to your password.
- Phishing: a message that tries to trick you into revealing details or clicking a harmful link.
- Warning signs: urgency, threats, unexpected attachments, odd sender addresses and links that do not match the real site.
Worked examples
Example 1: Choose a password
Question: Which is stronger: 'Summer2025!' or 'purple-tractor-window-seven'?
- Length matters most, and the second is longer.
- The second is made of unrelated words, so it is harder to guess.
Answer: 'purple-tractor-window-seven'
Example 2: Spot the phish
Question: An email says 'Your account will be closed in 1 hour. Click here now.' What should you do?
- The urgent threat is a warning sign.
- Do not click. Go to the official site directly, or contact the organisation using details you already trust.
Answer: Do not click; check through the official site
Example 3: After a mistake
Question: You entered your password on a fake site. What next?
- Change the password immediately on the real site and anywhere else you used it.
- Turn on 2FA and tell a trusted adult or your IT team.
Answer: Change passwords, enable 2FA and report it
Common mistakes
- Reusing the same password on several accounts.
- Clicking links in unexpected messages.
- Sharing codes sent to your phone.
- Posting personal details such as your address or school.
Practice questions
Frequently asked questions
What should I do if I clicked a suspicious link?
Change the password of any account you may have entered, turn on 2FA, and tell a trusted adult, teacher or your IT team.
Is a password manager safe?
A reputable password manager protected by a strong master password and 2FA is generally safer than reusing passwords.
Related guides
How the internet works: IP addresses, DNS and packets
Learn what happens when you open a website, from DNS lookups to packets and HTTPS, in plain English.
KS3GCSEMiddle SchoolHigh SchoolHow AI works: machine learning and chatbots for students
Understand machine learning, training data and large language models, plus the limits of AI and how to use it responsibly.
KS3GCSEMiddle SchoolHigh SchoolExam stress: practical ways to cope and when to ask for help
Practical, non-medical ways to cope with exam pressure, from planning and breaks to talking to someone you trust.
GCSEA-LevelHigh SchoolAP+1Sources and review
Reviewed by StudyMorrow editorial review on 5 Nov 2026.