Coding activity
Cybersecurity Quest
Practice a 'secret password' to enter the pillow fort. Wrong word? You can't come in!
Materials and setup
- paper
- pencil
How this changes by age
Pre-K (ages 3–4)
Practice a 'secret password' to enter the pillow fort. Wrong word? You can't come in!
Steps
- Build a simple pillow fort or pick a doorway as the entrance.
- Pick a fun secret password together (like 'banana sparkle').
- Parent stands guard. Anyone who wants to enter must say the password.
- Try a wrong password on purpose: parent says 'NOPE, you can't come in!' Then say the right one and enter.
- Switch roles — child becomes the guard and chooses a new password.
- Tell a grown-up one thing that surprised you.
Learning objectives
- Understand that some places need a secret to enter
- Match a spoken word to a stored 'rule'
- Practice keeping a secret
Kindergarten (ages 5–6)
Design a 4-symbol secret code using drawings, not letters. Test it with a sibling.
Steps
- Pick 4 symbols you can draw: a star, a heart, a moon, a triangle (or any 4).
- Choose a SECRET ORDER for the symbols — this is your 'password.' Write it down on a hidden card.
- Make a 'lock screen' on paper: 4 empty boxes where someone has to draw the symbols in the right order.
- Test it with a sibling or parent. They get 3 tries to guess. Wrong order = locked out.
- Switch roles. Solve someone else's symbol code.
- Tell a grown-up one thing that surprised you.
Learning objectives
- Design a non-alphabet secret code with ordered symbols
- Understand that order matters in a password
- Practice keeping a code secret while testing it
Early elementary (ages 6–8)
Design a paper 'lock screen' with a 4-digit PIN and a lockout rule. Act out being the device.
Steps
- Draw a phone lock screen on paper with 10 number buttons (0-9) and 4 empty boxes for the PIN.
- Choose a secret 4-digit PIN and write it on a hidden card.
- Write the rule on your paper: '3 wrong guesses = locked for 1 minute.'
- Have a family member try to unlock it. You ARE the device: check each guess against the PIN. Track wrong guesses with tally marks.
- On the 3rd wrong guess, announce 'LOCKED' and start a 1-minute timer. No guesses allowed during lockout.
- Discuss: why is this rule important? (It stops people from trying every PIN forever.)
- In one sentence, tell a parent or sibling what surprised you today.
Learning objectives
- Design a basic authentication interface
- Implement a rate-limiting rule by hand
- Explain why lockout rules protect accounts
Upper elementary (ages 8–10)
Write pseudocode for a password-protected mini-game with IF/ELSE and a lockout counter. Then learn how to spot phishing emails.
Steps
- Write pseudocode for a password gate. Example: SET wrong_count = 0. ASK guess. IF guess == PIN: PRINT 'Access granted'. ELSE: wrong_count = wrong_count + 1. IF wrong_count == 3: PRINT 'Locked for 30 seconds'. WAIT 30. wrong_count = 0.
- Trace through your pseudocode by hand for 3 scenarios: (a) right on first try, (b) wrong twice then right, (c) wrong three times then locked.
- HOW REAL SYSTEMS DO IT (EXPONENTIAL BACKOFF): a flat 30-second lockout still lets a guesser just wait and retry forever. Real systems use EXPONENTIAL BACKOFF — the lockout gets longer each time (for example: 30 seconds, then 2 minutes, then 10 minutes, then 1 hour). Each wrong streak costs the attacker way more time than the last. Upgrade your pseudocode: track a lockout_level, and on each new lockout use lockout_time = 30 seconds * (4 ^ lockout_level).
- Discuss with a parent: why is the lockout rule important? (Without it, an attacker could try every PIN.) Why is exponential backoff better than a flat lockout?
- Now learn about phishing emails. A phishing email tries to trick you into giving away a password. Common warning signs: urgent language ('your account will close TODAY'), weird sender address, asking for your password, threats, or links to a fake login page.
- With a parent, look at 2-3 real or example phishing emails. For each, list every red flag you can spot.
- Make a 'phishing detector' card you can keep near your computer with the top 5 warning signs.
- In one sentence, tell a parent or sibling what surprised you today.
Learning objectives
- Write pseudocode using IF/ELSE and a counter to enforce an authentication rule
- Trace conditional logic across multiple scenarios
- Identify common phishing warning signs in real messages
Safety and evidence note
Read the full activity before beginning. An adult should supervise tools, heat, food, outdoor work, movement, and experiments as appropriate. Completion records that the activity was done; the child’s explanation, work sample, photo, or demonstration is stronger evidence of learning than a completion check alone.
Related coding activities
AI Explorers
Train a pretend 'robot brain'! Show it 5 cat pictures and 5 dog pictures, then test if it can guess a new one.
Algorithm Art
Follow step-by-step drawing instructions to create a picture. The instructions are your algorithm! Each step adds one shape or line.
API Restaurant
Play restaurant! The customer tells the waiter what they want, the waiter tells the kitchen, and the kitchen makes it. The waiter is the messenger — just like how computers talk to each other!
App Design Workshop
Design your dream app! Draw what you'd see on a phone screen. What would your app do? What buttons would it have?