Creating your child's first email account

30 August 2026 · by Sharath · for parents · 5 min read

Your child needs an email address before they can sign in anywhere. Here is how to make one you can see into, on an account that stays under your supervision until they are ready to take it over.

Your child needs an email address before they can sign in to anything, and the first one you make will quietly decide how much you can see for the next few years. It takes about ten minutes.

The short answer: make it inside your own account as a supervised child account, use a handle rather than their name, never their surname or their exact birthday, and turn on a recovery phone number that is yours.

The long answer is below.

Which kind of account

There are three real choices, and the differences matter more than the brand.

A supervised child account. Google Family Link and Apple's Family Sharing both do this. You create it, it belongs to your family group, and you can see and change what it does. This is the right default for a child under about 11.

A shared account you own. You make an ordinary account, you know the password, and your child uses it with you. Simpler, no family group to set up, and no automatic controls. Good for light use, or if you already tried Family Link and found it heavy.

Their own private account. For an older child, and only when you have already had the conversations below. Not for a nine year old starting out.

Choosing the address

Decide the address before you start typing.

1. Use a handle rather than their name. Something like pixiefox@ or silentforge@ says nothing about them and sounds better anyway.
2. If it needs to look formal, for school, then sam2015@ is still a bad address: it announces the year they were born. sam-builds@ or samcodes@ says nothing and still sounds like them.
3. Never put a surname in the address. A first name and something they like is plenty, and it stays private if the address leaks.
4. Consider not using their exact date of birth when signing up. Shift the day or the month. The year is the part that decides what the account is allowed to do, so leave that honest. For anything official, use the real one.
5. Use a real recovery phone number, and make it yours. This is the single thing that gets an account back when it goes wrong, and it will go wrong.
6. Write the password on paper and keep it at home, at least for the first few weeks. A password nobody can find is the same as a lost account.
7. Turn on two step sign in, to your phone rather than theirs. Expect to be pestered when it signs them out.

Choosing a password

What makes a password bad

• Short. Anything under 12 characters falls to a brute force attack quickly.
• Dictionary words, names, teams, bands, or anything guessable from the family's social media.
• Personal data: birthdays, pet names, phone numbers, addresses.
• Keyboard patterns: qwerty, 123456, abc123, password1.
• Predictable substitutions. P@ssw0rd! swapping @ for a and 0 for o is the first thing a cracking tool tries.
• Reused anywhere else. One breach then unlocks everything.
• A small change to an old one, like Summer2025! becoming Summer2026!.

What makes one good

• Build it from something they will not forget. A favourite character, a favourite food, then bend the spelling: Naruto loves ramen and wants to be Hokage becomes R@@mEN80kA63.
• Or use a passphrase of four to six unrelated words: stapler-mango-vault-drizzle. Pick the words at random rather than choosing ones that go together, because words that go together are guessable.
• Length beats symbols. A 20 character passphrase is stronger than an 8 character jumble and far easier to type.
• One per account, including the ones that feel unimportant. A base with a variation works: R@@mEN80kA63<Goog>1, R@@mEN80kA63(App)2.
• Turn on two factor authentication, by app or by text.
• Check whether an address has been in a breach at haveibeenpwned.com, and turn on its alerts so you hear about the next one.

What to say while you do it

Do this bit with them watching. It is the whole lesson.

Three sentences worth saying out loud:

• This address is how a computer knows it is you, so it only goes to people we know in person.
• Anything that arrives asking for a password is lying, every time, with no exceptions.
• If something feels wrong, show me. Nobody gets in trouble for showing me early.

That last one is the one that matters. A child who expects to be told off will hide the thing you most need to see.

Should I read their emails?

While they are small, yes, openly and with them knowing. The point is not surveillance, it is that you are the one who notices the first strange message. Say plainly that you can see it. An agreement is worth more than a secret.

What about a phone number?

Do not give a child's email account its own phone number. Use yours for recovery. It means an account can always come back to you.

When do they get it to themselves?

When they can tell you what a phishing email looks like, or describe something that felt wrong, without being prompted. That is a better test than an age.

Zaalyo is a small Saturday coding school. Ask for a place, or read the others.