Technologies K–10 · Years 9–10
Why systems store password hashes, not passwords
Computing Technology 7–10 (NSW, 2022); Digital Technologies: Knowledge and understanding, Digital systems (ACARA v9)
This site has no interactive model of its own. Where a step or a material names a Concept Studio model, simulation or tool, it has not been built; an external simulation a step names (for example PhET) is not part of this site.
The idea
A cryptographic hash turns any password into a fixed-length digest that cannot be reversed, and a one-letter change alters about half the digest's bits, so a system can check passwords without storing them.
What you need
- Computer with Python 3 (hashlib and secrets modules)
- A table of made-up practice passwords (never real ones)
How to do it
- Compute hashlib.sha256(b'password').hexdigest() and the same for b'Password'.
- Count how many of the 256 bits differ between the two digests.
- Hash a one-letter password and a 100-letter password and compare the digest lengths.
- Build a small login check: store only the digest, and on login hash the typed password and compare.
- Give two practice users the same password and show their stored digests match; then add a random 16-byte salt from secrets.token_bytes(16) to each and show the digests now differ.
- Replace SHA-256 with hashlib.pbkdf2_hmac using many iterations and time 100 logins; explain why a slow hash helps defenders.
What you should see
SHA-256('password') is 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8 and SHA-256('Password') is e7cf3ef4f17c3999a94f2c6f612e8a888e5b1026878e4e19398b23bd38ec221a; they differ in 140 of 256 bits, about half, from a single changed letter. Every digest is 64 hexadecimal characters (256 bits) whatever the input length. The login check works without the stored table holding any password, and salting gives users with the same password different stored values, so one cracked digest does not reveal the others. The learner knows it worked when their digests match these exactly.
What changes
This activity lists no variables to change, measure and keep the same.
Common misconceptions
Each of these ideas is wrong, and the activity is a chance to test it.
- Hashing is encryption that can be reversed with a key (a hash cannot be reversed).
- Similar passwords give similar hashes (one changed letter changes about half the bits).
- Hashing alone makes weak passwords safe (common passwords are cracked by hashing guesses).
Safety card
Hazards
- Real passwords typed into shared computers
Controls
- Use only made-up practice passwords
Note
No chemicals or heat.
Curriculum references
The NSW syllabus outcomes and Australian Curriculum v9 codes this activity supports. They are references, not a verified or complete curriculum alignment.
- Computing Technology 7–10 Syllabus (2022), NESA. Current elective syllabus. Code read from the outcomes page on 2026-09-22.CT5-SAF-01CT5-DAT-01
- Australian Curriculum v9AC9TDI10K01
Sources
The pages the author read to write this activity.