How do I teach encryption to middle schoolers?
How do I teach encryption to middle schoolers?
Start with codes students can crack by hand, then show why those codes fail and what modern encryption does differently. A Caesar cipher, a substitution cipher and a padlock-box puzzle carry most of the ideas a middle schooler needs: keys, breaking codes and sharing secrets with strangers. Below you will find misconceptions, classroom moves, a five-lesson sequence and ready-made units for Grades 6–9.
See the encryption unitTeach encryption as turning a readable message into scrambled text that only someone with the right key can turn back. Begin with a Caesar cipher students encrypt and break by hand, move to substitution ciphers and letter-frequency attacks, then use a padlock-and-box puzzle to show how two people who never met can share a secret. Finish by connecting these ideas to the padlock icon in a browser and to secure messaging apps.
Ready-made material
AI & Cybersecurity Units Bundle, Grades 6–9
6 resources in one download: $89.99 instead of $149.94 bought separately.
The first cover is the main resource; the others are related options. Open any cover for the full contents and price.
AI & Cybersecurity Units Bundle | How AI Works, Prompting, Phishing, Encryption & Data Privacy | 6 Units | Grades 6–9
Coding & Computer Basics Units Bundle | Algorithms, Python, Binary & How the Internet Works | 4 Units | Grades 6–9
Computer Science Activities Bundle | Artificial Intelligence, Python Programming, Cybersecurity & Digital Literacy | Middle School Grades 7–10
AI Literacy & Cybersecurity Activities | Artificial Intelligence, Prompt Engineering & Online Safety | Grades 7–10
Digital Citizenship Activities | Cyberbullying, AI, Social Media & Media Literacy Lessons | Grades 7–10
Why it is hard
Where encryption lessons go off track
Students arrive thinking encryption and passwords are the same thing. A password lets you into an account; encryption scrambles data so it is useless without a key, and the difference matters. Many also confuse encoding with encryption. After a lesson on binary, a student will proudly say a message in ones and zeros is secret, when anyone with a chart can read it. Another belief is that a cipher is safe as long as nobody knows the trick, which is exactly what codebreakers have exploited for centuries. Students also misread the browser padlock: they take it as proof that a website is honest, when it only means the connection is encrypted. In class, encryption lessons often stop at fun puzzles. Students enjoy shifting letters but never see why a Caesar cipher falls in minutes or why the big problem in modern encryption is sharing the key. The opposite trap is jumping straight to prime numbers and public-key math, which loses most of a seventh-grade class. The sweet spot is hands-on ciphers that students build and then break, followed by a physical model of key exchange.
What works
Hands-on ways to teach codes and keys
Every move below works with paper, pencils and a few envelopes. Let students attack each other's codes; breaking a cipher teaches more than making one.
- Build cipher wheels from two paper circles and have pairs send Caesar-shifted notes to each other.
- Ask students to break a Caesar message by trying all 25 shifts and timing how long it takes.
- Give groups a long substitution-cipher paragraph and a letter-frequency chart to crack it.
- Write the same word in binary and in a cipher, then ask which one is actually secret.
- Act out the padlock box: send a box locked by one student, add a second lock, return it.
- Show a browser address bar and ask what the padlock promises and what it does not.
Step by step
Five lessons from Caesar to the padlock
The sequence follows the history of the problem, from simple secret writing to sharing keys safely. Treat each lesson as a guide for one period.
- Lesson 1: Secret writingStudents make cipher wheels, encrypt a short message and swap it with a partner who knows the key. Introduce plaintext, ciphertext and key as the three words they will use all week.
- Lesson 2: Breaking CaesarPairs receive messages without the key and try every shift. Discuss why only 25 possible keys make the cipher weak, and how a computer would try them all in an instant.
- Lesson 3: Substitution and frequencyGroups crack a substitution cipher using letter frequency and common short words. Students explain why more possible keys alone did not make the code safe.
- Lesson 4: The key problemRun the padlock box activity. Students work out how two people can exchange a secret without ever sharing a key, then compare this with a public and a private key.
- Lesson 5: Encryption around usConnect the week to secure websites, messaging apps and phone locks. Students write a short explanation for a parent of what the browser padlock means and what it does not.
Ready-made option
A complete cryptography unit you can teach tomorrow
Cryptography: Understanding Encryption is one of six units in the AI & Cybersecurity Units Bundle ($89.99, parts bought separately $149.94). Like the others, it includes worksheets on four levels, a detailed reading text, a hands-on deep-dive task, slides for the whole unit and answer keys with a marking guide. The bundle adds phishing, data protection, AI, prompting and filter bubbles. Bought alone, the encryption unit costs $24.99. To separate encoding from encryption properly, the Coding & Computer Basics Units Bundle ($69.99) has a unit on binary and digital images. For Grades 7–10, the Computer Science Activities Bundle ($119.99) also includes cryptography and encryption among its ten units.
Honest limits
What you add yourself
The unit explains concepts at a middle school level; it does not teach the mathematics of modern algorithms in depth, and it includes no software, apps or coding environment. Materials such as paper for cipher wheels and envelopes or boxes for the padlock activity come from your own supply. Compare the lessons with your state's computer science standards before you schedule them. Use within your own teaching is covered; for team use, message Teach Lessons first. If the unit is not right for your class, you can exchange it within 7 days for store credit of equal value.
Good to know
More teacher questions
What is the best first cipher to teach?
The Caesar cipher. It is quick to learn, works with a paper wheel, and is easy to break, which sets up the most important lesson of the unit. After students have both used it and cracked it, they understand why a key with many possible values matters.
How much math do students need for this topic?
Very little for Grades 6–9. Counting, alphabet positions and simple patterns are enough for Caesar and substitution ciphers. Modular arithmetic can appear informally as wrapping around from Z back to A. Prime numbers and public-key math can be mentioned as the next step without students calculating anything.
How do I explain public-key encryption simply?
Use an open padlock. Anyone can snap your padlock shut on a box, but only you have the key that opens it. You hand out padlocks freely, which is the public key, and keep the key, which is the private key. The padlock box activity lets students test this physically.
Is the encryption unit aligned with state standards?
No alignment claim is made for the unit, whether with CSTA or with any state's standards. Encryption and data security show up in many middle school computer science frameworks, but each state words and places them differently. Map the unit's lessons to your own standards and mark any gaps before teaching.
Can students code a cipher in this unit?
The unit is built around understanding encryption, not programming. If your class has learned some Python, writing a Caesar shift program makes a strong extension, using whatever setup your school already has. The Programming with Python unit covers variables, input and loops, which are enough to start.
Why does my class need to know about encryption at all?
Students rely on it every time they log in, send a message or buy something online. Knowing what encryption protects, and what it cannot protect, helps them judge websites, understand why passwords should never be shared, and make sense of news stories about privacy, data leaks and security.
Let them break a code first
Hand out cipher wheels and a Caesar message and watch the class crack it. The unit can take care of the readings, leveled tasks and answer keys for the rest of the sequence.
See the encryption unit