← Back to Blog Mobile Security

How to teach kids strong passwords and 2-step login

The strongest password habit you can teach a child is a long passphrase, a different one for every account, plus 2-Step Verification on their email and key apps. Length matters more than symbols: the US National Institute of Standards and Technology (NIST) says services should not force special characters or regular password changes.

Below is a plain-language version, with steps a parent and child can do together in about 20 minutes.

NIST’s current guidance (SP 800-63B, revision 4) says a password used on its own should be at least 15 characters, and that services should accept passwords of at least 64 characters so passphrases work. It also says services should not impose composition rules such as mixing character types.

In practice, a phrase of several unrelated words beats a short password full of symbols. A child can remember four unrelated words far more easily than a jumble like Tr0ub4dor&3. Make up your own, with words that have nothing to do with each other, and avoid song lyrics, names, birthdays or anything a classmate could guess.

When one site leaks passwords, attackers try the same email and password on other services. If your child reuses a password, one leaked game account can open their email. NIST says services should check new passwords against lists of common and breached passwords, which shows how widespread the problem is.

2-Step Verification asks for a second proof after the password, such as a prompt on a phone or a code from an authenticator app. Even if someone learns the password, they cannot get in without it.

1. Open the child’s Google Account, then Security, then 2-Step Verification.
2. Add a parent’s phone number or a second device as a backup, so your child is not locked out.
3. Save the backup codes somewhere safe that only a parent can reach.
4. Repeat on other important accounts, starting with email, because email can reset every other password.

Prefer prompts or an authenticator app over text-message codes where you can, because a swapped or stolen SIM can expose SMS codes. We explain how in SIM swap attacks.

2-Step Verification also unlocks a feature many parents miss: Google says you must turn it on to remotely lock or erase a lost Android phone (Google support).

For most children old enough to have several accounts, yes. NIST says services should allow password managers, autofill and pasting, so a manager is a supported way to use long, unique passwords. A parent-managed vault works well for younger children, and teens can run their own while a parent holds a recovery option. Google’s account includes a built-in password manager, and many other apps offer one.

• Passwords are private. Share them only with a parent, not even with a best friend.
• Do not save passwords in notes, screenshots or chat messages.
• Lock the phone itself with a PIN or biometric, because an unlocked phone opens every saved login.
• Change a password straight away if you think someone saw it. NIST says passwords should change when there is evidence of compromise, not on a calendar.
• Do a 10-minute check-up every few months: new accounts, old accounts to delete, and whether the backup options are still current.

Our phone security checklist covers the rest of the basics.

Paxio does not store or see your child’s passwords, and it does not replace a password manager or 2-Step Verification. It handles time limits, app blocking and content filtering. The help here is indirect: blocking apps your child should not be on means fewer accounts to protect.

About the author: Naveenkumar Arulmani is the founder of Paxio, an Android parental control app for screen time limits, app blocking and content filtering. We build Paxio, so we are not neutral, and where it does not help we say so.

Try Paxio free →