Learn Dark Web

Learning Path

Password and Account Security

Your accounts are protected by passwords, and most of them are weaker than they should be. The good news is that the rules have got simpler: length matters more than complexity, uniqueness matters more than cleverness, and a password manager does the hard work for you. This path takes you from your first strong password to a full account-security setup, one afternoon's work spread over six lessons.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

How this path works. Each lesson below is a short summary written for this path, with a link to the full guide. Work through them in order, mark each one complete when you have read the guide, and test yourself with the quiz at the end. Your progress is stored only in your own browser — no account, nothing sent to us. This path teaches understanding, not credentials: completing it does not give you a certificate and does not qualify you for a job.

What you will learn

This path is for anyone with accounts to protect — which is everyone. It assumes no technical knowledge, and every tool it recommends is free and runs in your own browser.

  • Create long, unique passwords for every account — and remember only one master password.
  • Explain password entropy in plain English, and why the commonly quoted targets disagree.
  • Check whether your passwords have appeared in known breaches, safely, without sending your password anywhere.
  • Understand passkeys, and why they are replacing passwords on many services.
  • Know exactly what to do after a data breach, including which account to fix first.
  • Turn on two-factor authentication where it matters most, and keep your recovery codes safe.

Your progress

0 of 6 lessons complete.

The lessons

Read each lesson summary, then open the full guide it links to. The summaries are written for this path — they do not repeat the guides, they prepare you for them.

Lesson 1: Password security fundamentals

Passwords are still the key to most of your digital life, and most of them are weaker than they should be. Attackers rarely guess a password one try at a time: they steal passwords in data breaches, capture them through phishing, or buy them from earlier breaches and try them everywhere else. A password that is long, unique and never reused defeats most of those attacks at once.

This lesson covers the fundamentals, anchored in the current guidance from NIST, the US National Institute of Standards and Technology. Its current edition says a password used on its own should be at least 15 characters long, and it drops the old rules about forced symbols and regular password changes — those mostly made passwords harder for people without making them much harder for attackers. The practical rule is simple: aim for length, use a passphrase of random words or a generated password, and never reuse a password across accounts.

Read the full guide: Password security fundamentals

Lesson 2: What is password entropy?

Entropy is the measure of how hard a password is to guess, counted in bits. Each extra bit doubles the number of guesses an attacker would need, so a password with 60 bits of entropy is roughly a billion times harder to crack than one with 30 bits. This lesson explains the idea without any mathematics beyond doubling: it is the number of possibilities, not the number of characters, that protects you.

You will also learn why the advice about how many bits you need disagrees — some sources say 50, some 60, some 80 — and why none of them is wrong. The right target depends on what the password protects, how fast an attacker can guess, and how long the password must stay safe. A password for a rarely used forum needs less entropy than the master password of your password manager. The lesson ends with the practical translation: a long passphrase of random words reaches the high targets comfortably, and a short complex password does not.

Read the full guide: What is password entropy?

Lesson 3: Check if your password was leaked — safely

When a company is breached, the passwords it stored can end up in the hands of criminals, who try them on every other service. So it is worth checking whether your passwords have appeared in a known breach — but the check itself must be safe. Typing your real password into a random website that promises to check it is exactly the wrong way to do it: you have just handed your password to a stranger.

This lesson explains the safe way, called k-anonymity: your browser hashes your password, sends only the first few characters of the hash to the checking service, and compares the rest locally. The service never sees your password or even its full hash, and nothing you type leaves your device. You will learn how to use a k-anonymity checker, what to do with the answer, and — most importantly — that the fix is always the same: change the leaked password, and change it everywhere else you reused it.

Read the full guide: How to check if your password was leaked safely

Lesson 4: What are passkeys?

Passkeys are the replacement for passwords that is already rolling out on major services. Instead of a secret you type, a passkey is a pair of cryptographic keys: a private key that stays on your own device, and a public key stored by the service. When you sign in, your device proves it holds the private key — usually with your fingerprint, face or PIN — and no password ever crosses the network.

This lesson explains why that design defeats phishing in a way passwords cannot: there is nothing to steal in a fake login page, because the private key never leaves your device and will not sign in to a lookalike site. You will learn where passkeys already work, what happens if you lose your device, and the honest limits — not every service supports them yet, and recovery arrangements differ. Passwords will be with us for years, but passkeys are the direction of travel, and this lesson shows you how to start using them where they are offered.

Read the full guide: What are passkeys?

Lesson 5: What is a data breach?

A data breach is an incident in which data is copied or exposed without permission — for example when a company's customer database is stolen. This lesson explains the lifecycle of a breach: how attackers get in, what they take, how stolen data is traded and reused, and why the harm often arrives months later, in the form of phishing messages built from the stolen details.

You will also learn the practical side: what to do when a service tells you it has been breached, and in what order. The priority is your email account first, because access to your email lets an attacker reset almost everything else; then banking and payment accounts; then everything else. The lesson walks through the mock breach-checking screens in our breach explainer tool, so you can see how checking works without ever entering a real email address — and it explains why this site will never offer a live breach checker that accepts real personal data.

Read the full guide: What is a data breach?

Lesson 6: Identity theft and how to protect yourself

Identity theft is what happens when someone uses your personal details — your name, address, identification numbers, or account credentials — to pretend to be you: opening accounts, taking loans, or making purchases in your name. This lesson explains the main ways it happens, from data breaches to phishing to information overshared on social media, and why it is often discovered months after it started, when a bill or a debt notice arrives.

The lesson is organised as a practical plan rather than a list of fears. First the prevention: unique passwords, two-factor authentication, and care about what personal details you post publicly. Then the detection: checking statements, watching for accounts you did not open, and knowing the warning signs. Then the recovery: the official routes to report identity theft in your country, what evidence to keep, and why you should act quickly and keep a written record of every step. Recovery is slow but it works, and this lesson shows the order to do it in.

Read the full guide: What is identity theft?

Try the tools

These free tools let you practise what the lessons describe — everything runs in your browser, and nothing you type is sent anywhere.

Check what you learned

Four questions, all based on fictional scenarios. Answer them all, then check your score — each answer explains itself, so a wrong answer teaches as much as a right one.

Answer all four questions, then check your score.

Download your notes

Download a plain-text summary of this path: the lesson list, which lessons you marked complete, and your quiz score. The file is generated on your device — nothing is uploaded.

Key terms in this path

The glossary defines every term this path uses: password entropy, two-factor authentication, data breach, encryption. If a lesson uses a word you do not know, look it up there — each term page also explains the idea with an example.

Frequently asked questions

How long should my passwords be in 2026?

Current NIST guidance (SP 800-63B Revision 4, July 2025) requires a password used on its own to be at least 15 characters long, and allows as few as 8 characters when it is only one factor of multi-factor sign-in. Services must accept at least 64 characters. A passphrase of four random words comfortably passes the bar.

Is a password manager safe to trust with all my passwords?

A reputable password manager encrypts your passwords in a vault locked by one master password, and generates long, unique passwords for every account. Turn on two-factor authentication for the vault, and store your master password and recovery codes safely on paper at home.

Should I still change my passwords every 90 days?

No. Current guidance says services should not require periodic changes, because it drove people to make small, predictable changes instead of genuinely new passwords. Change a password when there is a reason: a breach, a phishing attempt, a shared account, or evidence it was compromised.

What is the single most important password habit?

Uniqueness. Give every account its own password, starting with your email — because access to your email lets an attacker reset almost everything else. A password manager makes this practical, and two-factor authentication means a stolen password alone is not enough.

Are passkeys going to replace my passwords?

On many large services, yes — passkeys are already an option and they defeat phishing in a way passwords cannot. But not every service supports them yet, and recovery arrangements differ. The sensible approach is to use passkeys where offered and keep strong, unique passwords with two-factor authentication everywhere else.