Online Safety
Password Safety for Kids: A Family Routine They Can Actually Use
Teach children to protect passwords and login codes, and prepare account recovery with an adult. Includes practice messages and a useful family routine.
Password safety for kids needs a simple everyday rule: account access is private, and a surprising login request can wait while a trusted adult helps check it. Children should not have to judge whether a friendly message is authentic before refusing to share a password or verification code.
Prepare the account and its recovery route together, using an arrangement permitted by the service's age rules. Do not create an adult account with a false birthday for a child.
Build the routine around three moments
Creating access: Use a strong, unique password for each account and an appropriate password manager where suitable. Avoid reusing a parent's personal password or a word friends could easily guess.
Signing in: Use the service's official app or a known address. Do not follow a surprise message simply because it says the account will be closed soon.
Recovering access: Know which legitimate recovery route belongs to the account and which adult can help. Keep recovery information secure, not on a publicly visible family chart.
CISA's family cybersecurity guidance recommends strong unique passwords, password managers, and multifactor authentication. Follow the particular service's current setup and recovery documentation.
Explain login codes separately
A code sent during sign-in is not a friendship test, a prize claim, or something to hand to a person claiming to be support. Teach the child to pause and ask before approving an unexpected request.
Where multifactor authentication is available and appropriate, set it up with a recovery plan. Extra security is less useful if the family cannot recover access after the responsible device is lost.
Practice with invented messages
| Message | A useful response |
|---|---|
| “Send your code so I can give you free coins.” | Do not send it; show an adult |
| “I'm your friend. Let me use your account for a minute.” | “I don't share my login. We can play another way.” |
| “Your account will disappear in ten minutes. Click here.” | Open the official service independently with an adult |
| “Approve this login even though you did not start one.” | Do not approve; check account security through the official route |
Use the words on paper. There is no need to open a real suspicious link to rehearse the decision.
Make the adult's role transparent
Explain who can help recover the account and what information they may need to manage it. Avoid promising unlimited privacy while secretly retaining access, or claiming parental tools can see everything inside an account.
For a teen, discuss how responsibilities will change as they become more independent. The family's recovery arrangement should remain understandable to both sides.
If something has already been shared
Move to the official account recovery and security process promptly. Change compromised credentials where appropriate, review active sessions using official instructions, and secure any other account that reused the password. Do not pay a stranger who promises recovery.
Thank the child for telling you. A harsh response can make the next disclosure harder, while the immediate task is protecting access.
Our gaming scams guide covers common pressure tactics. If the child is still using an adult's Apple Account, use the account-separation guide before making changes that could affect photos, purchases, or saved data.
Sources
We identify organizations and evidence types so readers can evaluate each claim. See our editorial policy.
- family cybersecurity guidance — Cybersecurity and Infrastructure Security Agency. Source guidance.