A password is checked by hashing it again and comparing, never by reversing a stored value. This set covers why that matters, how to make a strong secret, and how the permissions on a private key tell you whether it is safe.
Each one is marked as you go, and the explanation arrives straight after, which is
the part worth reading.
4 questions, marked as you go.
Tasks
These need your own device. Run the command in Termux, then paste what it printed.
The marking looks at what the output means, so spacing, version numbers and
ordering do not matter. If you have not installed anything yet, the
lesson covers the setup.
Hash a passphrase, then make a real secret
This hashes the same passphrase twice, then reads 32 random bytes from the system. Watch the first two lines and then the third: the hash is identical both times, and the random secret would be different every time you ran it.
Run this in Termux
On your own device. Nothing on this page executes it. The command runs in
your terminal, and this box only reads what you paste back.
When sha256sum reads from a pipe rather than a file, it prints the digest, two spaces, then a single dash.
the same passphrase produces the same digest twice
a base64 secret of 32 random bytes follows
the commands actually ran
What a good answer looks like
Three lines. The first two are identical, because the same input always produces the same digest. That is exactly what makes a hash useful for checking a password without storing the password itself. The third line changes every time you run the command, because it came from the random device rather than from words you chose. The contrast is the lesson: a hash is predictable, and a secret must not be.
Marking your own work
Both halves of this are checked in your browser, with no server involved, so nothing
stops you from pasting output you did not run. The tasks are written so that the
easiest way to pass one is to actually do it and read the result, which is the whole
intention.