Practice status

{{ summaryValue }}

{{ summaryLine }}

Build a practice round

Practise account-security decisions with 30 original scenarios. Choose a topic, account context or difficulty set; each set is a separate practice focus. No passwords, codes or account details are requested.

Curated source edition: 11 September 2026. CISA Secure Our World guidance, cross-checked with FTC and NIST; Google-specific recovery details are labelled. Independent learning material, with no agency or provider endorsement.

Optional. Blank uses account-practice-1. The same seed, set and mode reproduce the round. Do not enter passwords, codes or account details; the seed is included in the share link.

{{ seedNotice }}

{{ quizSetupValidation }}

{{ Math.round(progressPercent) }}%
{{ answeredCount }} of {{ questionCount }} answered

{{ progressStatusLine }}

Question {{ quizCursor + 1 }} of {{ questionCount }}

{{ currentQuestion.stem }}

{{ currentQuestion.accessible_clue }}

{{ currentResultRow.feedback }}

{{ currentResultRow.explanation }}

Source: {{ currentResultRow.source.reference }} · {{ currentResultRow.source.version }} · {{ currentResultRow.source.license }}

Answer recorded. Explanations appear at the end of the round.

Review what to practice next

{{ resultLead }}

This score describes these practice questions only. It is not a security audit, qualification or assurance that an account is safe.

{{ learningReviewTitle }}

{{ learningReviewLine }}

{{ card.label }}
{{ card.value }}
{{ card.note }}

Missed answer review

  1. {{ item.prompt }}

    Your answer: {{ item.selected_answer_label }}

    Correct answer: {{ item.correct_answer_label }}

    {{ item.explanation }}

    Source: {{ item.source.label }} · {{ item.source.version }} · {{ item.source.license }}

Study sources and scope

Six questions per topic, across personal, household and small-organisation contexts. Foundations and applied decisions are authored difficulty labels, not measured ability levels. Random subsets are not balanced assessments.

Topic performance

Which account-security topics need another look? Compare correct and missed answers in this round; topic sample sizes can differ.

Loading topic-performance chart…

{{ quizChartStatus }}

{{ quizChartExportStatus }}

Answer ledger

Question ID Prompt Topic Your answer Correct answer Outcome Explanation Source Copy
{{ row.question_id }} {{ row.prompt }} {{ row.category_label }} {{ row.selected_answer_label }} {{ row.correct_answer_label }} {{ row.outcome_label }} {{ row.explanation }} {{ row.source ? `${row.source.label} · ${row.source.version} · ${row.source.license}` : '—' }}

{{ quizLedgerExportStatus }}

Password Strength Calculator Check a password against predictable patterns and attack scenarios, compare estimated crack times, and keep the candidate in your browser.
Secure Password Generator Generate a unique password in your browser with adjustable character rules, unbiased random selection, and clear strength estimates.
Phishing Awareness Quiz Practice spotting phishing cues and choosing safer responses in 30 fictional scenarios, with answer explanations and focused retries for missed questions.
U.S. Consumer Scam Awareness Quiz Recognize U.S. consumer scam tactics in realistic scenarios and learn why independent checks and safer responses matter before acting.

A password exposed by a shopping site can also put an email account at risk when the same secret protects both. If that inbox receives password-reset messages, access to it may let an intruder take over other accounts too. Different passwords for different services limit how far one exposed secret can reach.

Length, randomness and uniqueness solve different problems. A long password built from a public name and birthday remains predictable, while a randomly generated password loses an important protection when it is reused. A passphrase is a password made from several words. Unrelated words chosen at random avoid the familiar patterns found in quotations, song lyrics and personal details.

A password manager makes separate passwords practical by generating, saving and filling them. Its vault is the protected collection of saved credentials, so the password that unlocks it deserves particular care. A strong, unique vault password and an additional authentication factor, where offered, help protect that collection. Saving passwords does not remove the need to protect the manager itself or plan how to regain access.

Multi-factor authentication (MFA) checks a sign-in using more than one kind of evidence. Two-factor authentication uses two of these kinds, rather than simply asking two questions.

Something you know
A secret such as a password or a memorised personal identification number (PIN).
Something you have
Control of an authenticator, such as a security key or a device that provides a verification code.
Something you are
A biometric characteristic, such as a fingerprint used to unlock an authenticator.

The available method matters. Text-message verification adds protection when the alternative is a password alone, but stronger supported methods are preferable. A rotating code can still be captured by a fake sign-in page and passed to the real service while it is valid. Phishing-resistant authentication is intended to prevent that kind of impersonation, not merely to make a code expire sooner.

Recovery needs attention before a phone is lost, replaced or erased. Recovery contact details should lead to accounts or numbers the owner still controls, and backup codes need secure storage that remains accessible without the missing device. A convenient recovery route can also become an intruder's route into an account, so it deserves the same care as the normal sign-in method.

Software maintenance addresses another source of risk. Updates fix software weaknesses; a strong password, a password manager or MFA does not install those fixes. Equally, updating a device does not undo an account takeover. Reliable account protection depends on sign-in safeguards, recovery arrangements and maintained devices working together, without treating any one of them as a guarantee.

How to Use This Tool:

The initial setup is a 10-question round using All topics — mixed practice with feedback after each answer. The 30 original text scenarios are English-language consumer-security practice, not checks of a real account.

  1. Choose a Practice focus. Keep mixed practice, select one topic, or choose personal, household, small-organisation, foundations or applied-decisions practice. These are alternative question groups, not filters that can be combined.
  2. Choose Feedback timing. After each answer reveals the correction and explanation immediately. End of the round records each choice without revealing correctness until the completed review. Both use the same scoring rule.
  3. Select an offered Question count. Changing focus changes the available counts and replaces a count that no longer fits with that focus's default.
    Under Advanced, an optional Replay seed accepts up to 128 characters. Blank uses a fixed default, so it does not create a fresh random round each time. Surrounding spaces are ignored. An invalid or overlong value produces a notice and uses that default. Use only non-sensitive text.
    If Start practice is disabled, choose an available practice focus, feedback timing and question count.
  4. Select Start practice and answer each scenario by choosing one of four options. Your choice locks immediately for that attempt. Use Next question to continue; there is no skipped-question or early-finish result.
  5. Select View results after answering the last question. Read Missed answer review and the Answer ledger to connect each choice with its correction, explanation and source.

Interpreting Results:

During a round, Practice status and the progress bar count answers recorded, not answers correct. At the end, the summary changes to correct answers out of questions selected. Reaching 100% progress means that every question has an answer, even if some or all of those answers are wrong.

The Topic performance chart compares correct and missed answer counts, not standardised ability scores. Short rounds can contain unequal numbers of questions from different topics, and an untested topic is not rated. Review focus points to a category with the most misses in that round; it does not identify the most serious weakness in your actual accounts.

Retry missed starts a separate attempt containing only the questions answered incorrectly. Replay same seed repeats the same challenge, while Try a new seed can change question selection and option order but may include familiar questions. A Perfect round has no missed-only retry. Repeating a known answer can reinforce it, but does not establish that the underlying decision will transfer to a new situation.

There is no pass mark, pass/fail band, certification or account-security rating. The score applies only to the selected practice questions and does not audit passwords, account settings or incident-response competence. Use the explanations to identify a specific action to verify in the provider's genuine account settings or with your organisation's authorised support team.

Technical Details:

A one-time code limits reuse after it has been accepted, but a fake sign-in page may relay it before that happens. Web Authentication (WebAuthn) instead supports cryptographic proof bound to the legitimate service. This distinction explains why adding a second factor and resisting phishing are related but different properties.

Authentication methods and phishing resistance

Count the kinds of evidence involved, then consider whether that evidence can be forwarded to an impostor's sign-in attempt.

Sign-in combination Evidence Important limit
Password and another memorised PIN Two knowledge secrets Two prompts alone do not establish two different factors.
Password and a texted verification code Knowledge plus access to the receiving phone number Adds protection over a password alone, but phone-number takeover and code phishing remain risks.
Password and a rotating authenticator-app code Knowledge plus control of the authenticator Avoids relying on text-message delivery, but a manually entered code can still be relayed.
Password and a supported WebAuthn security key Knowledge plus possession of a key that produces service-bound proof Resists lookalike-site relay; does not make recovery routes or the device immune to compromise.

A PIN used locally to unlock a physical authenticator is different from a second memorised secret typed into a website. The local PIN can activate proof that the person also possesses the authenticator. The meaning depends on what the PIN unlocks, not whether it contains digits.

Remember-device choices also change later sign-ins. A public computer should not be trusted to bypass future verification prompts, and the account should be signed out when finished. An unsolicited caller's support claim is not a reason to disclose a verification code; contact support independently through a known legitimate route.

Password changes and the scope of a rule

The National Institute of Standards and Technology (NIST) SP 800-63B-4 distinguishes arbitrary password expiry from evidence of compromise. Within its framework for credential service providers and verifiers, it prohibits requiring periodic changes solely because time has passed, but requires a change when there is evidence that the authenticator has been compromised. A verifier is the service that checks the password. This guidance is not permission for an employee to disregard an organisation's actual policy.

A known exposure is therefore different from an unchanged password reaching a particular age. When an exposed password was reused, replacing it only at the breached service leaves the other accounts using that secret at risk. Distinct replacements remove that reuse, rather than preserving it with a predictable suffix or number change.

Recovery and maintenance protect different routes

Regaining the ability to sign in does not necessarily remove an intruder's continuing access. Other signed-in sessions, altered recovery contacts and email-forwarding rules may remain. After recovery, a new unique password, signing out other sessions and reviewing those settings address different ways that access or information could persist.

Operating-system, browser, app and security-software updates repair weaknesses in those products. They do not automatically revoke remote account sessions or restore recovery details. Use the legitimate update process and complete required installation or restart steps. On managed equipment, follow the approved process rather than bypassing administration. An unexpected repair pop-up is not a trusted support channel.

Practice coverage and repeatability

The curated question-bank edition is 11 September 2026. There are six scenarios each for passwords, password managers, MFA methods, account recovery and software updates. The following round sizes describe the available practice groups, not levels of security competence.

Practice group Questions in group Offered round sizes Default count
All topics — mixed practice 30 1, 3, 6, 10, 15, 30 10
Any single topic 6 1, 3, 6 6
Personal, household or small-organisation accounts 10 each 1, 3, 6, 10 10
Foundations or applied decisions 15 each 1, 3, 6, 10, 15 10

Questions are selected without replacement, so one question does not appear twice within a round. Reproduction requires the same seed, practice group, feedback timing, question count and question-bank edition. A full 30-question round always uses all 30 scenarios; changing the seed does not create additional content. Short selections are not guaranteed to balance topics.

The foundations and applied-decisions labels are author-assigned practice groupings, not measured difficulty or ability levels. The scenarios draw on U.S. public security guidance and explicitly identified provider rules, not an exhaustive or internationally uniform security curriculum. They are independently authored, with no agency or provider affiliation or endorsement. Provider options and workplace requirements can change, so a dated learning example does not replace current instructions.

Counting correct answers, progress and misses

Each question has one keyed answer among four choices. A correct answer earns one point and an incorrect answer earns zero, with no partial credit, deduction or difficulty weighting. Let C be correct answers, A be answers recorded and N be questions selected. The score is C points out of N possible points, ranging from zero to N.

Accuracy divides correct answers by the selected round size. Progress divides answers recorded by that same round size, while misses count only recorded incorrect answers.

Score points = C Accuracy (%) = 100×CN Progress (%) = 100×AN Missed answers = A−C

C, A and N are counts of questions and are integers satisfying 0 ≤ C ≤ A ≤ N, with N ≥ 1. Points count correct answers; accuracy and progress are percentages. Accuracy retains its unrounded calculated value. Only the visible progress label rounds to the nearest whole percent, with half-percent ties upward; the completed headline shows the exact correct/selected fraction. Unanswered questions remain in N but are not misses or missed-retry items. A partial attempt has no completed result or replay; completion requires all N answers.

Privacy Notes:

No passwords, verification codes or account identifiers are requested or tested. Answers are scored in the browser. Attempt data in the URL is not encrypted or private progress storage: the page address carries the round settings, seed, selected answers and current position, including partially completed attempts.

  • Anyone receiving a working attempt link can restore the recorded choices. Treat the link as a disclosed practice record, and never put credentials or personal details in the replay seed.
  • The address may remain in browser history or be transmitted when opened or shared. External chart resources may also load. Browser scoring does not establish that the site makes no network requests or keeps no access logs.
  • Change setup clears the current attempt and its address-carried state, not earlier history entries or shared copies. There is no account-based progress history.

If Saved attempt unavailable appears, use the setup controls to start a new round. Incompatible, outdated or invalid saved attempts are rejected rather than treated as completed results.

Worked Examples:

A full round followed by a focused retry

Choose All topics — mixed practice, 30 questions and End of the round. Suppose 28 answers are correct, with one miss in MFA methods and one in account recovery. The summary is 28/30. Those two topics each have five correct answers and one miss; the other three each have six correct. Retry missed then starts a two-question attempt. Answering both correctly produces 2/2 for that retry, not a revised 30/30 for the original round. The useful follow-up is to explain why those two earlier choices were wrong.

A replacement set of Google backup codes

Choose Account recovery with six questions. In the scenario where a Google account user has generated replacement backup codes after losing the old sheet, choosing that both sets remain valid is incorrect. The Answer ledger explains that generating the new set makes the previous set inactive. A code also becomes inactive after use. Keep the current set securely accessible without relying solely on the phone it may need to replace. These are Google-specific rules for the backup-code option in that scenario, not a promise that every provider offers or handles recovery codes the same way.

References: