🐍Stuck on syntax? Open the Python cheat sheet — variables, loops, errors & camp recipes
🔐 Project · Session 3 · ~75 minutes

Mission: Python Password Projects

Build four small Python tools that teach you how passwords actually work — from a basic login check to the real cryptographic trick that protects every password you've ever made. By the end you'll understand why password123 is a disaster and what makes a password truly strong.

🔊 NARRATION

1️⃣ What you're building

Four small Python projects, each one building on the last. Together they explain how the entire world's password system works.

PROJECT 1 🔑 Simple login Build a basic username + password checker. Then realise why it would be a terrible way to run a real website.
PROJECT 2 👁️ Password masking Hide passwords behind **** while you type — using the maskpass library. Protects against shoulder-surfers.
PROJECT 3 🔐 Cryptographic hashing The big one. Learn the one-way scrambling trick (SHA-256) that lets websites check your password without ever storing it.
PROJECT 4 💪 Strength checker Build a real tool that grades passwords weak/medium/strong based on length, variety, and patterns.

2️⃣ Key concepts — learn these first

Each project teaches one big idea. Read through these now (or hit the 🔊 Hear this button on each one) so the notebook makes sense from the very first cell.

🔑 Concept 1 — How a login check actually works

Every time you log in (Roblox, your school account, Minecraft) the website does the same two checks:

  1. Does this username exist?
  2. Does this password match the one we have stored?

If both = yes, you're in. If either = no, you're locked out. That's it. The whole web runs on this idea.

if username in users and users[username] == password: print("✅ Welcome back!") else: print("❌ Login failed.")

⚠️ The catch: in Project 1 the passwords sit in a Python dictionary in plain text. If a hacker reads that file, they can see every password. Real websites don't do this — and Project 3 shows you why.

👁️ Concept 2 — Why we hide passwords behind ****

When you type a password into a phone or website, it shows up as ••••••. That's not for security — it's for privacy. The password itself is unchanged. The dots just stop the person standing behind you from reading it off the screen.

This is called shoulder surfing. It's a real attack — especially at school, in libraries, on the bus, or during a video call where someone screen-shares by accident.

# Normal input — password is visible as you type password = input("Password: ") # Masked input — shows asterisks instead import maskpass password = maskpass.askpass(prompt="Password: ", mask="*")

Big idea: security ≠ privacy. Masking protects privacy from nearby humans. Hashing (next concept) protects security from hackers.

🔐 Concept 3 — Hashing: the trick that protects every password on Earth

The problem: websites need to check your password is right. But if they store the actual password, a single break-in spills every account in the database.

The trick: websites don't store your password. They store a scrambled fingerprint of it, called a hash. The scrambling is one-way — you can't unscramble it back.

  1. You type sunshine123
  2. The website runs it through SHA-256, getting 0d1ee2c5ef… (always 64 characters)
  3. The website stores the hash. The real password is thrown away forever.
  4. Next time you log in, it hashes your typed password again and compares the two hashes. Match = you're in.
🍓 The Hash Blender — hashing in slow motion
Think of SHA-256 as a magic smoothie machine. Press play and watch what it does — slowly.
① Your password goes in
✳️
③ A fingerprint pours out
press play…
🚫 You can't un-blend a smoothie back into fruit — and you can't reverse a hash back into the password.
👋 A smoothie blender only works one way — fruit in, smoothie out. A hash works exactly the same. Press ▶ Watch & listen.

🤯 The avalanche effect (side-by-side)

Here's the magic. Change one letter of your password and the hash becomes completely, totally different. Watch:

Password 1
sunshine123
SHA-256
2c9341ca4cf58e0c98425b6c4e7d3a6c6a4f9b0e1b8d3a5e9f0c2b6d4a7e8c1f
Password 2 (changed last digit)
sunshine124
SHA-256
a7f1e9c3b5d8047c2e6b4f9a3c8e0d2f6a1b9c5e7d3f4a8b2c6e0f9d4a3b5c1e
Password 3 (just capitalised the S)
Sunshine123
SHA-256
f3c1d8e6a4b2c0e5d9f7a3b1c5e8d4f2a6b0c9e7d5f3a1b8c4e2d6f0a9b7c3e5

Three passwords, almost identical. Three hashes that look like nothing related to each other. That's why hashing works — there's no pattern an attacker can follow.

Reality check: if your password is in the top 10,000 most common passwords, attackers have a list of pre-computed hashes (a "rainbow table") and your hash gives them away anyway. Real sites add a random salt per user to defeat this. We don't cover salt in the notebook — it's a topic for next week.

💪 Concept 4 — What makes a password truly strong

Even with hashing, a weak password is still weak — attackers just guess every possibility until one matches. Your password's strength comes from how many possible combinations a guesser has to try.

The maths bit: each character you add multiplies the guesses.

• Lowercase only: 26 options per character

• + numbers: 36 per character

• + uppercase + symbols: ~95 per character

For an 8-character password:
→ Lowercase only: 208 billion combos
→ All four types: 6,634 trillion combos 🤯

Project 4 builds a real checker that scores passwords on 5 things: length, lowercase, uppercase, numbers, special characters. Here's what it'll look like:

password ⚠️ WEAK
password123 ⚠️ WEAK
Password123 👌 MEDIUM
MyDog$Name42 💪 STRONG
correcthorsebatterystaple 💪 STRONG

Surprise winner: the long lowercase-only phrase beats the short "complex" one. Length wins. Every time.

🎯 Your turn — guess the strength! 0 / 0 correct

Look at the password, then drag the slider into the strength zone you think fits. Land in the right zone and it counts as a win.

••••••
Very weakWeakMediumStrongVery strong
50% · Medium

3️⃣ How to use the notebook (Google Colab)

Python doesn't run inside a normal web browser, so we use Google Colab — a free tool that lets you run Python in the browser. Five steps:

  1. Download the notebook — click the yellow Download notebook button below. It saves a file ending in .ipynb.
  2. Open Google Colab — click the purple Open Google Colab button. (You need to be signed in with a Google account — your school one works fine.)
  3. Upload the notebook — in Colab, click File → Upload notebook, then pick the .ipynb file you just downloaded.
  4. Run the cells in order — click the ▶ play button on each cell, top to bottom. Each cell either explains an idea or runs some code.
  5. Try the experiments — every project has "Think about it" sections and bonus challenges. Don't skip them.

4️⃣ The 5 rules of a really strong password

Once you've finished the notebook, these are the rules that will keep your accounts safe in real life:

RULE 1
📏 Length first
At least 12 characters. The longer it is, the harder to crack — exponentially.
RULE 2
🎨 Mix it up
Uppercase, lowercase, numbers, AND symbols. Every type you add multiplies the guesses.
RULE 3
🤫 No personal info
Pet names, birthdays, favourite teams — attackers find these on Instagram in 30 seconds.
RULE 4
🔁 Never reuse
One leaked password = every account using it is broken. Different password per site.
RULE 5
🤖 Use a manager
A password manager creates and remembers complex passwords for you. You just remember one.

💡 Pro tip from real security pros

  • A passphrase like correct-horse-battery-staple is easier to remember AND harder to crack than P@ssw0rd!. Length beats complexity.
  • If a website limits you to 8 characters, it's a sign the website is old and insecure. Use a unique password there and don't trust it with anything important.
  • Turn on two-factor authentication (2FA) on every account that supports it. Even a leaked password won't unlock the account without your phone.

5️⃣ If something goes wrong

"ModuleNotFoundError: No module named 'maskpass'"
You skipped the install cell in Project 2. Scroll up and run the cell with !pip install maskpass --quiet first. Then try again.
"ModuleNotFoundError: No module named 'hashlib'"
Shouldn't happen — hashlib is built into Python. If you see this, you're probably running a really old Python. In Colab this never breaks.
The input() box won't let me type
Click inside the input field that appears at the top or bottom of the cell output. Sometimes Colab puts it in an easy-to-miss place.
My hash is different from my friend's, but we typed the same password
Check for sneaky differences: a trailing space, a capital letter, a zero vs. an O. The avalanche effect means ANY difference = totally different hash.
The strength checker says my real password is "weak"
Good — that's a sign you should change it. Run the checker on a new password idea until it scores STRONG, then use that one.
Colab keeps asking me to sign in
Use your school Google account. If your school blocks it, ask your teacher — they may have a class Colab link set up.

🚀 Ready to start

Download the notebook, open Colab, upload it, and press play on each cell from the top. Take your time — the four projects are designed to be done in order. By the end you'll have written real cryptographic code.