Build four small Python tools that teach you how passwords actually work — from a basic login check to the real cryptographic trick that protects every password you've ever made. By the end you'll understand why password123 is a disaster and what makes a password truly strong.
Four small Python projects, each one building on the last. Together they explain how the entire world's password system works.
**** while you type — using the maskpass library. Protects against shoulder-surfers.
weak/medium/strong based on length, variety, and patterns.
Each project teaches one big idea. Read through these now (or hit the 🔊 Hear this button on each one) so the notebook makes sense from the very first cell.
Every time you log in (Roblox, your school account, Minecraft) the website does the same two checks:
If both = yes, you're in. If either = no, you're locked out. That's it. The whole web runs on this idea.
⚠️ The catch: in Project 1 the passwords sit in a Python dictionary in plain text. If a hacker reads that file, they can see every password. Real websites don't do this — and Project 3 shows you why.
****
When you type a password into a phone or website, it shows up as ••••••. That's not for security — it's for privacy. The password itself is unchanged. The dots just stop the person standing behind you from reading it off the screen.
This is called shoulder surfing. It's a real attack — especially at school, in libraries, on the bus, or during a video call where someone screen-shares by accident.
Big idea: security ≠ privacy. Masking protects privacy from nearby humans. Hashing (next concept) protects security from hackers.
The problem: websites need to check your password is right. But if they store the actual password, a single break-in spills every account in the database.
The trick: websites don't store your password. They store a scrambled fingerprint of it, called a hash. The scrambling is one-way — you can't unscramble it back.
sunshine1230d1ee2c5ef… (always 64 characters)Here's the magic. Change one letter of your password and the hash becomes completely, totally different. Watch:
Three passwords, almost identical. Three hashes that look like nothing related to each other. That's why hashing works — there's no pattern an attacker can follow.
Reality check: if your password is in the top 10,000 most common passwords, attackers have a list of pre-computed hashes (a "rainbow table") and your hash gives them away anyway. Real sites add a random salt per user to defeat this. We don't cover salt in the notebook — it's a topic for next week.
Even with hashing, a weak password is still weak — attackers just guess every possibility until one matches. Your password's strength comes from how many possible combinations a guesser has to try.
The maths bit: each character you add multiplies the guesses.
• Lowercase only: 26 options per character
• + numbers: 36 per character
• + uppercase + symbols: ~95 per character
For an 8-character password:
→ Lowercase only: 208 billion combos
→ All four types: 6,634 trillion combos 🤯
Project 4 builds a real checker that scores passwords on 5 things: length, lowercase, uppercase, numbers, special characters. Here's what it'll look like:
Surprise winner: the long lowercase-only phrase beats the short "complex" one. Length wins. Every time.
Look at the password, then drag the slider into the strength zone you think fits. Land in the right zone and it counts as a win.
Python doesn't run inside a normal web browser, so we use Google Colab — a free tool that lets you run Python in the browser. Five steps:
.ipynb.File → Upload notebook, then pick the .ipynb file you just downloaded.Once you've finished the notebook, these are the rules that will keep your accounts safe in real life:
correct-horse-battery-staple is easier to remember AND harder to crack than P@ssw0rd!. Length beats complexity.!pip install maskpass --quiet first. Then try again.hashlib is built into Python. If you see this, you're probably running a really old Python. In Colab this never breaks.input() box won't let me typeDownload the notebook, open Colab, upload it, and press play on each cell from the top. Take your time — the four projects are designed to be done in order. By the end you'll have written real cryptographic code.