“You had 30 children in the classroom screaming, ‘I don’t know my password’, ‘I can’t remember my password’. [It is] really stressful!”
Mrs Samantha Williams | Deputy Headteacher
Every minute spent on forgotten passwords is a minute of lost learning. And cybersecurity standards for schools are getting stricter, and passwords need to be more secure.
The good news is that you have more options than ever: magic badges (QR code badges), PINs, one-time links, and typed or emoji passwords. But the right choice for one person, whether it’s a student, office staff, or governor, isn’t always right for another. What works for a child at 7 probably won’t work for them at 14, and what suits a SEND learner probably won’t suit your teachers. Your logins need to fit your school, your team, and your security needs, and grow with your students as they move up.
This guide outlines how a staggered approach to logins can fit your school’s structure and curriculum, based on our in-house expertise and government guidance.
What we’ll cover:
When to start introducing passwords to your students
Children are online earlier than ever. Ofcom reports that 19% of three to five-year-olds have their own mobile phone. Your pupils probably know what a password is before they start school. What they’re less likely to know is why passwords matter, and how to look after them.
If your students use devices and apps, they should be learning how to create, store, and manage their login details. UK Council for Internet Safety’s (UKCIS’s) Education for a Connected World framework supports this. Most schools map their online safety curriculum to it, and it introduces simple rules about creating and protecting passwords from age four.
The main login methods used by schools
Log in methods have moved well beyond the standard typed password. Here are the options best suited to school-age learners.
| Login method | How it works | Additional information |
|---|
| Typed passwords | They can mix numbers, uppercase and lowercase letters, and special characters. | Most common login method, but susceptible to overused or forgotten passwords. |
| Emoji passwords | A sequence of emoji, most often used with single sign-on tools such as MyLogin. | They’re easier for young children to engage with and remember than a string of characters. |
Magic badges
(QR code badges) | Physical badges that students or teachers scan with a device’s camera. | They completely replace typed login details, so there’s nothing to remember. |
| PIN codes | Usually 4 to 6 digits. They’re fast, best for quick access to a device and generally used as recovery methods. | Not commonly used for protecting sensitive accounts. Easy to watch someone type it. |
| Magic links | A passwordless option. A unique, one-time login link arrives by email. | Need an email account. Works well for staff but rarely for younger pupils. |
What to consider when choosing login methods for students and teachers
Consider your options in two ways: what each individual needs, and what your whole school needs.
Considerations for the individual
Age | Younger students need logins they can remember and manage on their own, so they stay engaged rather than waiting for an adult.
Additional learning needs | Many Special Educational Needs and Disabilities (SEND) learners find memorising and typing passwords hard. A badge or picture-based login lets them start learning straight away.
Accessibility | A magic badge may not suit a pupil with a visual impairment, and typed passwords can be hard for some learners with motor difficulties.
How many logins do they juggle | Each extra app adds another password to remember. The more there are, the more likely students are to reuse or forget passwords.
Considerations for your school
Your devices | Logging in to the device is often the first hurdle, before pupils even reach an app. Magic badges need a working camera, and on shared devices you need to think about how logins are cleared between users.
Your apps and software | The more apps and platforms your school and students use, the more accounts, resets, and support tickets you have to manage.
Account lifecycle | When staff and students join, leave, or move up, how will you manage their access?
Staff workload | How much time can you afford to lose on resets? This is often the cost that persuades Senior Leadership Teams (SLT) to change from typed passwords to a simpler alternative.
Home access | Will the login work on a home device, without anyone to help? This can apply to students doing homework or teachers working from home.
Are you part of a Multi-Academy Trust? | Using the same approach across your schools makes training, support, and transitions easier.
Looking across both lists, the same challenge keeps coming up: different learners need different logins, but more logins mean more for your team to manage. That’s where your choice of sign-in tool comes in.
Single sign-on vs password management | What should your school choose?
Single sign-on (SSO) and password managers both make logging in easier, but they’re often confused, and they work in very different ways.
Single sign-on (SSO) lets a user log in once and get into their device and all their apps without signing in again. Students don’t need a separate password for every app, so you can choose the login method that suits each learner, such as a magic badge, emoji, or typed password, and it works everywhere.
MyLogin is Wonde’s single sign-on tool for schools. It connects to your MIS, so student and staff accounts are created and removed automatically.
A password manager, such as 1Password, stores a different, strong password for each account in an encrypted vault. The user remembers one master password, and the tool fills in the rest. They usually rely on a typed password and require more user management than SSO.
Which should you use?
For most schools, SSO does most of the work. Your students get a single login for their device and apps, your IT team can see and control who has access, and accounts update automatically when students join or leave. Password managers are still useful for staff who manage admin accounts or systems that SSO doesn’t cover. A combined approach gives you the best coverage.
What types of passwords should your students be using?
Catherine Thompson, Product Manager at Wonde, recommends these login methods for different school groups. They follow the stages most schools already use for online safety, so your login approach moves on as your pupils’ password skills develop.
“Magic badges are the simplest option, with no password to remember. Pupils hold up a badge and they’re in, which frees up learning time and avoids frustration.”
“Emoji passwords are a stepping stone between magic badges and full typed passwords. Pupils start learning what a password is, and why it’s private, without the stress of spelling and special characters.”
“Use typed passwords, ideally long passphrases, paired with a second factor such as a magic badge.”
“For staff who handle sensitive data, I’d use the same approach as teachers, but with an authenticator app as the second factor.”
Top tip from Josh Spoelstra
“Make it a lesson. Run a story writing session where each emoji is a part of the story. A dog, a rocket, a moon, and a cake become “the dog flew a rocket to the moon to find cake”. Pupils see that a password is a sequence they build and remember, and the same idea carries straight over to passphrases later on.“
Josh Spoelstra | Head of Product Marketing at Wonde
Adding extra protection with MFA
Whichever methods you choose, the strongest setups add a second factor with multi-factor authentication (MFA). MFA means combining two different types of proof:
- Something you know, such as a password or emoji sequence
- Something you have, such as a magic badge, phone, or authenticator app
Your MFA options with MyLogin
| Combination | True MFA? | Best for |
|---|
| Emoji password + magic badge | Yes | Primary and secondary students |
| Typed password + magic badge | Yes | Secondary students, teachers, and staff |
| Typed password + authenticator app | Yes | IT admins and office staff handling sensitive data |
| Emoji password + typed password | No, both are things you know | Extra protection, but not a replacement for MFA |
Secure single sign-on with MyLogin
Whichever methods you choose, the strongest setups add a second factor with multi-factor authentication (MFA). MFA means combining two different types of proof:MyLogin gives every learner the right login for their stage in the curriculum. Use magic badges for your youngest pupils, emoji passwords as they grow, and typed passwords with MFA for older students and staff. Everyone has one sign-on for their device and apps.
- Grows with your students. Move pupils from magic badges to emoji passwords to typed passwords as they reach each stage, without changing systems or creating new accounts.
- Fewer resets. One login for every app means fewer forgotten passwords.
- Full visibility. See who has access, reset logins in seconds, and remove access straight away.
- Devices as well as apps. Pupils use the same badge, emoji, or password to sign in to the device itself, so there’s one login from the moment they pick up a tablet.
- Safe on shared devices. Pupils’ accounts and data stay private, even on shared tablets.
Already use Wonde? Your Management Information System (MIS) is already connected, so accounts are created, updated, and removed automatically. If you’re new to Wonde, getting connected is simple.