Did you know that a login screen asking for your password, a page asking for a one-time password, and a device offering a passkey are asking you to prove who you are in different ways? Those words sound similar, but mixing them up can lead to the wrong action at exactly the moment when someone is trying to trick you.
Here is the useful answer: a password is a secret you know and enter; a one-time password or OTP is a temporary code used in an authentication flow; and a passkey is a cryptographic sign-in credential, usually unlocked on a trusted device, that is designed to work for the legitimate service rather than for a lookalike phishing site. Understanding the distinction helps a student or parent recognise which requests make sense, which requests should never be answered, and why a code is not automatically safe just because it expires quickly.
Start with a real problem: a convincing but unexpected login message
Imagine a fictional Secondary 3 student receiving an email that appears to come from a learning platform: “Your account will close in ten minutes. Verify using your password and the code sent to your phone.” The sender claims urgency and provides a link. The safe reading task is not to decide whether the logo looks official. It is to distinguish claim from evidence and authentication from requesting secrets. A student should not enter credentials into a link supplied by an unexpected message. Instead, use the app or known official site independently and ask a trusted adult or school IT staff where appropriate.
This scenario is a teaching example, not a report of a real school incident. The Cyber Security Agency of Singapore’s August 2026 guidance on passwordless authentication explains why weak or reused passwords and some one-time-code flows remain vulnerable to phishing. The Singapore Police Force account-safety advisory recommends strong, unique passwords and multi-factor authentication.
Password: a secret you remember or store securely
A password is a secret string used to demonstrate knowledge during sign-in. A passphrase is a longer sequence of words used in a similar role. Neither should be copied from another account or shared in a group chat. A password manager can help generate and store unique credentials, but learners must understand which application they are using and how to recover access safely.
Notice the collocations: enter a password, reset a password, reuse a password, compromise credentials. To reset means to establish a new secret through an authorised recovery process; to reuse means to apply the same secret elsewhere. Reusing creates a shared vulnerability: a leak from one service may endanger other accounts that use identical credentials.
A password screen can be genuine, but a fake page can copy its appearance. The most important sentence is not “The page looks professional,” but “I reached the known official service through a trusted path.” Even the correct vocabulary cannot replace careful verification of the site, app and request.
OTP: one-time describes the code’s lifetime, not its trustworthiness
An OTP is a one-time password or verification code used to confirm a step in a sign-in or transaction. Some codes arrive by SMS or email; others are generated by an authenticator application. They have limited use or validity according to the service. That can sound reassuring, but the word one-time does not mean impossible to steal. A scammer can sometimes persuade someone to enter a live code on a fake site or read it aloud.
The Singapore Police advisory dated 2 October 2026 describes phishing scams involving fraudulent shopping advertisements and warns consumers not to disclose OTPs. Students should learn the difference between a code they requested through a known legitimate process and an unexpected code or request. Never share an OTP with someone claiming to be school support, a bank officer, a delivery driver or a relative.
An unexpected OTP message may indicate that another person is attempting an action with your details. It does not necessarily prove that an account has already been breached. Do not guess at the cause; use the official service’s security guidance, review account activity where appropriate and seek help through known channels.
Passkey: the credential is tied to the legitimate service
A passkey is a credential based on public-key cryptography that can let a user sign in without typing a traditional website password. It is commonly unlocked with a device PIN, fingerprint or face recognition. In a normal passkey design, the private credential is not typed into a webpage, and the authentication is bound to the legitimate relying party. That is why passkeys are considered resistant to ordinary website phishing attempts.
The Government Technology Agency’s 27 July 2026 explanation introduces passkeys for Singpass and discusses protection against lookalike login pages. Availability, supported devices and enrolment arrangements are service-specific and can change; the term passkey alone does not promise that a particular school platform offers it today.
Here is a useful language contrast: a password is a secret a user might type into the wrong place; a passkey is a device- or manager-held credential that participates in a cryptographic challenge for the correct service. A passkey is not “a fancy password you can copy from your phone”. It has different mechanics, storage and recovery needs.
Multi-factor authentication and push approval are separate ideas
Multi-factor authentication (MFA) means checking identity with more than one factor or different kinds of evidence, according to the service’s design. A push approval is a request displayed in an authentication app asking the user to approve or reject a sign-in. It is not automatically safe: a user who approves an unexpected request can authorise someone else’s session. The CSA notes that passwordless methods differ in their resistance to phishing; a familiar notification is not the same security guarantee as a domain-bound passkey.
Parents can teach three simple responses: if you initiated a sign-in, read the app’s prompt and verify that it corresponds to what you are doing; if you did not initiate it, do not approve; if in doubt, open the service from a known official starting point rather than tapping an unexpected link. No student should be instructed to demonstrate this with real account passwords in class.
The vocabulary map students can keep in their heads
- Password: a secret string used at sign-in. Important verb: enter. Risk to notice: reuse or disclosure.
- Passphrase: a sequence of words serving as a password. Important verb: protect.
- OTP: a time- or use-limited code. Important verb: verify. Never give it to an unsolicited caller.
- Passkey: a cryptographic credential usually unlocked on a trusted device. Important phrase: phishing-resistant authentication.
- Push approval: a prompt asking whether to authorise a particular sign-in. Important choice: approve or reject.
- Recovery method: a way of regaining access after a lost device or changed account settings. Important verb: recover through official channels.
An age-appropriate lesson using fictional screens
Primary learner: recognise the boundary around secrets
Write three pretend statements on paper: “Please tell the teacher your favourite colour”; “Please read the class notice”; “Please give me the code your phone received.” The child identifies which requests are ordinary class communication and which could reveal a secret. No real OTP or private data should appear in the exercise. The adult reinforces that even a friendly voice can ask for something it has no right to receive.
Secondary learner: identify a phishing request
Invented message: “Your exam platform has expired. Log in here immediately and send your OTP to support to restore access.” Ask the learner to underline urgency, unsupported authority and the request for a secret. Then rewrite a responsible response: “I will access the verified platform independently and contact official support if I see a genuine problem.” Notice how verified, official and genuine are claims to check, not magic words printed by the sender.
Adult learner: compare two login methods without overclaiming
In a fictional workplace briefing, someone says, “A passkey makes an account completely impossible to compromise.” Correct the claim: passkeys can protect against important classes of phishing, but they do not remove every risk from account takeover, compromised devices, malicious applications, poor recovery settings or social engineering. The more accurate explanation identifies a specific protection and its limits.
Diagnostic questions that reveal actual understanding
- Can you tell me what one-time describes in OTP, and what it does not guarantee?
- Why is a passkey different from typing a password into a website?
- What should you do if an authentication prompt arrives when you are not signing in?
- Does a professional-looking logo prove the sender is authorised? What independent check would be stronger?
- If a device is lost, where should you look for the legitimate recovery process?
Ask for reasons rather than memorised slogans. A student who says “OTP means safe” needs the idea of real-time phishing. A student who says “passkey means face scan” needs the concept that biometrics or a device PIN commonly unlock a credential; the credential is not merely the biometric image. That correction improves both digital literacy and precise explanation.
Transfer the words to English, computing and adulthood
In English comprehension, learners distinguish a message’s claim from verifiable evidence. In computing, they encounter authentication (checking identity), authorisation (what an authenticated user may do) and recovery (regaining account access). In Mathematics, they learn not to convert a lower risk into a claim of zero risk. These distinctions matter for learning platforms, future workplaces, banking and family communication. They do not imply that any particular SEC G1, G2 or G3 syllabus includes passkeys as an examinable topic.
For the general learning method, follow the eduKate Vocabulary Learning Hub. For examples of applying vocabulary in explanations, use the Vocabulary in Real English Hub. The existing eduKate English Learning Hub remains the owner of broader reading and communication skills.
A no-password practice routine for home and school
Day one: write password, OTP, passkey and push approval on separate paper cards. Give one-sentence definitions, then match each word to an invented scenario. Day two: without looking, explain which terms can involve an easily shared code and which use a cryptographic device credential. Day seven: inspect a security-help article from a real service and ask what is supported and what is not. The class never signs into a real account or shares credentials as part of the lesson.
A useful completion criterion is this: when confronted with a new login instruction, the learner can accurately describe what proof is being requested, who is requesting it, and why that request should or should not be trusted. Fluency without those checks is not the same as understanding.
Frequently asked questions
Is an OTP more secure than having only a password?
Additional verification can improve security, but OTP-based methods still have vulnerabilities, including phishing. Use the protections supported by the legitimate service and never reveal codes to an unsolicited requester.
Does a passkey mean every app on my phone can use it?
No. Support depends on the individual service, device, software and account settings. Follow the official provider instructions.
Should I approve a sign-in request if a caller says it is urgent?
Not unless you have independently confirmed that you intentionally initiated the action and the details match. Unexpected approvals can be fraudulent.
Is face recognition itself the passkey?
Not usually. Biometrics or device PIN can unlock a cryptographic credential. The credential and the method of unlocking it are related but distinct.
A word can change a choice
The next time a student sees “OTP”, “passkey” or “approve sign-in”, they should understand the action before they click. That is why vocabulary is an everyday digital safety skill: clear language buys the time to verify, reject or seek help instead of obeying a convincing but false prompt.
Fact-check sources: CSA, Understanding Passwordless Authentication (2026); GovTech, Switch to Passkeys (27 July 2026); SPF, Safeguarding Online Accounts. All student messages and sample screens in this lesson are fictional.