Encryption for Kids: Teach It by Building Their Own Encrypted Radios

Kids can understand encryption years before they can spell it. The progression that works is short: a paper cipher, a shared key, the difference between a lock and a key, and then a real device that encrypts real messages. Four steps, roughly 90 minutes of activity spread over a few sessions, and a child comes out able to explain why “private” messaging is a claim about math rather than a promise from a company.

That matters more each year. Pew Research Center found in 2024 that 95% of US teens have or have access to a smartphone and 46% say they’re online almost constantly - and the messaging apps they live in make privacy claims kids have no framework to evaluate. This guide gives you the framework, the activities, the standards they map to, and the point where a physical build does something a worksheet can’t.

The Three Definitions Kids Need

Encryption (definition): Scrambling a message using a rule and a secret value (a key), so that anyone who intercepts it sees nonsense, while anyone holding the right key can reverse the process exactly.

Symmetric vs asymmetric: In symmetric encryption, the same secret key locks and unlocks the message - fast, but both sides must already share the secret. In asymmetric encryption there are two mathematically linked keys: a public key anyone can use to lock a message, and a private key only the recipient holds to unlock it.

End-to-end encryption (E2EE): The message is encrypted on the sender’s device and can only be decrypted on the recipient’s - so the service carrying it cannot read the contents. CISA’s mobile communications guidance recommends E2EE apps for exactly this reason.

Notice what’s missing: no algorithms, no primes, no jargon. Every one of those three ideas can be demonstrated with paper and a padlock.

Why This Belongs in a Kid’s Education Now

Three things changed the stakes.

Kids’ data is a business. In September 2024 the US Federal Trade Commission published a staff report on nine major social-media and streaming platforms, concluding they engaged in “vast surveillance” of users with inadequate safeguards for children and teens. That’s the environment a 12-year-old joins by downloading an app.

The rules are being rewritten. The FTC’s amended Children’s Online Privacy Protection Rule - the first substantial COPPA update since 2013 - took effect on 23 June 2025, with full compliance required by 22 April 2026. It broadens what counts as personal information, requires separate parental consent before disclosing children’s data to third parties for advertising, and imposes data-retention limits. In the EU, the Commission published guidelines on the protection of minors under the Digital Services Act in July 2025, including private-by-default accounts for minors. The UK’s Age Appropriate Design Code sets 15 statutory standards for services likely to be accessed by under-18s.

Notification volume outpaces judgement. Common Sense Media measured a median of 237 notifications a day reaching 11-to-17-year-olds. Kids aren’t short of digital exposure; they’re short of a mental model for what happens to what they send.

It’s Already in the Standards

Teachers sometimes assume cryptography is a high-school topic. It isn’t. The CSTA K-12 Computer Science Standards place it squarely in middle school:

• Grades 3-5 (1B-NI-05): discuss real-world cybersecurity problems and how personal information can be protected.
• Grades 6-8 (2-NI-06): “Apply multiple methods of encryption to model the secure transmission of information.” The standard’s own explanatory text ranges from simple letter substitution to modern methods, and names substitution ciphers as an example activity.
• High school: trade-offs and cybersecurity as a systems problem.

CSTA has announced revised PK-12 standards for summer 2026 that explicitly strengthen cybersecurity content. Outside the classroom, GenCyber - funded by the NSA and NSF - runs free cybersecurity camps for middle and high school students and their teachers, and NIST’s NICE programme maintains a K12 Cybersecurity Education Roadmap.

The workforce argument is blunt: ISC2’s 2024 workforce study put the global cybersecurity workforce gap at 4.8 million people. In its 2025 study, ISC2 stopped publishing a single global gap figure and reported instead that 95% of respondents identified at least one critical skills need. Either way, the pipeline starts in middle school.

The Four-Step Progression That Works

Each step is short, physical, and ends with the kid doing something rather than watching.

• Step 1 (20 min, Age 7+): Concept: A cipher is a rule. Activity: Caesar cipher: shift every letter by 3, exchange notes, then crack a sibling’s note by trying all 25 shifts.

• Step 2 (15 min, Age 9+): Concept: A key is a secret, and sharing it is the hard part. Activity: Two kids in separate rooms must agree a shift number using only messages passed through a third kid who reads everything.

• Step 3 (15 min, Age 10+): Concept: Locks and keys can be different. Activity: Padlock demo: a kid hands out open padlocks (public key) and keeps the only key (private key); anyone can lock a box, only they can open it.

• Step 4 (~2 h, Age 9+): Concept: Real systems do this automatically, over radio. Activity: Build a pair of encrypted communicators and send messages with no Wi-Fi or cell network involved.

Step 2 is the one adults underestimate. The moment a kid realises the message was easy and the key exchange was the actual problem, they’ve understood the central difficulty of cryptography - and why asymmetric keys were invented.

Step Four: Where a Device Beats a Worksheet

Paper ciphers stop being interesting once the novelty wears off, because nothing is at stake. Hardware changes that: a message that crosses a room by radio, arrives on a screen, and can’t be read by a phone in between feels consequential.

CircuitMess Chatter 2.0 ($149) is built for this lesson. The kit contains two handheld communicators kids assemble themselves - roughly two hours for the pair, no soldering - that send encrypted text messages directly to each other with no Wi-Fi and no cellular network, at a stated range of about 2 km. They’re programmable in CircuitBlocks, so after the messaging works kids can draw on the screen, add sounds, and modify behaviour.

Two teaching points come free with the hardware:

The radio layer. Chatter uses LoRa, a long-range, low-power radio technology operating in sub-GHz ISM bands (roughly 150-960 MHz) using chirp spread spectrum. Semtech, which developed it, cites line-of-sight ranges up to about 5 km in urban settings and 15 km in rural ones, with battery life measured in years. The kid-level lesson: lower frequency and lower data rate buy you distance and battery, which is why your phone’s Wi-Fi dies at the end of the garden and a LoRa device doesn’t. It also introduces infrastructure independence - these devices work where the network doesn’t.

The cipher layer. Real symmetric encryption today usually means AES, standardised by NIST as FIPS 197 in 2001 and still the workhorse: keys of 128, 192, or 256 bits, encrypting data in 128-bit blocks. Kids don’t need the internals. They need the shape: same key both ends, astronomically many possible keys, and the security lives in the key rather than the secrecy of the method.

One honest caveat worth saying out loud to older kids: a learning kit’s encryption is a working model, not a security product for people whose safety depends on it. Understanding that distinction - that “encrypted” is a spectrum with threat models, not a badge - is itself a core cybersecurity idea. The same principle applies to consumer apps, which is why our piece on what kids actually learn from building electronics argues for building over trusting.

Turning It Into Privacy Literacy

The device gets attention; the conversation gets the learning. Four questions that work with a 12-year-old, in order:

1. Who can read this? For a text, a DM, a school chat, a game voice channel. Make them guess, then look it up together.
2. Who stores it, and for how long? Introduces data retention - now a legal requirement under the amended COPPA rule.
3. What is the company getting? The FTC’s 2024 report is the citation; the answer is usually attention and profile data.
4. What would you do if you wanted to read someone else’s message? Attacker thinking, which is what actual security engineers do all day. Guessing the key beats breaking the maths, every time - which is why passwords matter.

Kids who can answer those four make better decisions than kids who’ve been told to “be careful online.” For a wider view of how these skills fit a long-term path, see our computer science roadmap from age 5 to 15.

Where It Leads Next

Encryption is one node in a bigger network topic. A kid who’s built a pair of radios is well positioned for IoT projects - connected devices where security is the hard part, not an add-on - and for understanding the ESP32 microcontroller that runs a huge share of hobby and commercial connected hardware. For a class set, the Retro Bundle 2.0 ($238) pairs Chatter 2.0 with the Bit 2.0 console, which gives you a communications unit and a coding unit from one purchase.

Frequently Asked Questions

How do you explain encryption to a child?

Start with a rule and a secret. Write a message where every letter shifts three places along the alphabet - that’s a Caesar cipher, and it’s 2,000 years old. The rule is the method, the number 3 is the key. Then point out the problem: how do you tell your friend the number is 3 without a third person overhearing? That question is the whole history of cryptography, and a seven-year-old can feel it.

At what age can kids learn about encryption?

Simple ciphers work from about age 7. The CSTA K-12 Computer Science Standards expect students in grades 6-8 to apply multiple methods of encryption to model secure transmission, and place discussion of protecting personal information as early as grades 3-5. Hands-on hardware kits in this space are typically recommended from age 9.

Is cybersecurity taught in schools?

Partially and unevenly. Cybersecurity concepts appear in the CSTA standards and many state CS standards, and Code.org reported that 60% of US public high schools offered foundational computer science in the 2024-25 school year. Dedicated cybersecurity instruction is much rarer, which is why out-of-school programmes like GenCyber camps and home projects carry real weight.

What is LoRa, and why use it to teach kids?

LoRa is a long-range, low-power radio technology that operates in sub-GHz bands using chirp spread spectrum, with line-of-sight ranges cited up to roughly 5 km urban and 15 km rural. For teaching, its value is that it works with no Wi-Fi, no SIM card, and no account - so the kid can see that communication doesn’t require a company in the middle.

Are DIY encrypted messaging kits actually secure?

Treat them as educational, not operational. A kit demonstrates real symmetric encryption over a real radio link, which is enough to teach keys, ciphertext, and threat models - but it hasn’t been audited like Signal or a commercial security product, and shouldn’t be relied on where safety is at stake. Saying so to kids teaches an important lesson about evaluating security claims.

What careers does this lead to?

Security engineering, network engineering, embedded systems, and cryptography research, plus adjacent roles in compliance and privacy. ISC2’s 2024 study put the global cybersecurity workforce gap at 4.8 million; its 2025 study found 95% of practitioners reporting at least one critical skills need. Demand is not the constraint - interest early enough is.

The Bottom Line

Encryption is one of the few advanced topics you can teach honestly with paper, a padlock, and an afternoon. Do the four steps in order and a kid ends up with something better than knowledge of a cipher: the instinct to ask who can read this, and how do I know? If you want the last step to stick, hand them hardware - a pair of build-it-yourself encrypted communicators from CircuitMess turns an abstraction into two devices on a kitchen table talking to each other with nothing in between.