Project: password strength checker: Python Programming (Intermediate)

The plan

Part	For our checker
Input	One password (a string)
Outputs	A score, a label (weak / medium / strong) and a list of reasons to improve
Steps	test each rule, add up the score, pick a label, collect messages for failed rules

The rules

Rule	How to test it in Python
At least 8 characters	len(pw) >= 8
A small letter	any(c.islower() for c in pw)
A capital letter	any(c.isupper() for c in pw)
A digit	any(c.isdigit() for c in pw)
A symbol like @ # ! ?	any(not c.isalnum() and not c.isspace() for c in pw)
Bonus: 12 or more characters	len(pw) >= 12

Think of it like this: Think of the lock on your house. A lock that opens with any thin wire is weak. More pins inside, a stronger body and a longer key make it harder to pick. Each password rule is one more pin; length is the biggest one.

Step 1: test each rule

python

def rules_met(pw):
    return {
        "length": len(pw) >= 8,
        "lower": any(c.islower() for c in pw),
        "upper": any(c.isupper() for c in pw),
        "digit": any(c.isdigit() for c in pw),
        "symbol": any(not c.isalnum() and not c.isspace() for c in pw),
    }

print(rules_met("mango123"))
print(rules_met("Mango@2026"))

A dictionary of True/False values: easy to count and easy to turn into messages.

Step 2: score, label and reasons

python

COMMON = {"password", "123456", "12345678", "qwerty", "india@123", "password@123"}
MESSAGES = {
    "length": "Use at least 8 characters",
    "lower": "Add a small letter",
    "upper": "Add a capital letter",
    "digit": "Add a digit",
    "symbol": "Add a symbol like @ or #",
}

def rules_met(pw):
    return {
        "length": len(pw) >= 8,
        "lower": any(c.islower() for c in pw),
        "upper": any(c.isupper() for c in pw),
        "digit": any(c.isdigit() for c in pw),
        "symbol": any(not c.isalnum() and not c.isspace() for c in pw),
    }

def check_password(pw):
    rules = rules_met(pw)
    score = sum(rules.values()) + (1 if len(pw) >= 12 else 0)
    reasons = [MESSAGES[name] for name, ok in rules.items() if not ok]
    if pw.lower() in COMMON:
        return {"score": 0, "label": "weak", "reasons": ["This is a very common password"]}
    if score <= 2:
        label = "weak"
    elif score <= 4:
        label = "medium"
    else:
        label = "strong"
    return {"score": score, "label": label, "reasons": reasons}

for pw in ["abc", "mango123", "Mango@2026", "Monsoon-Chai-2026", "India@123"]:
    print(pw, check_password(pw))

sum() of True/False values counts the Trues, because True counts as 1.

The score goes from 0 to 6: one point for each of the five rules, and one bonus point for 12 or more characters. 0 to 2 is weak, 3 or 4 is medium, 5 or 6 is strong. Common passwords are always weak, because attackers try them first.

Tip: Length beats tricks. "Monsoon-Chai-2026" is easier to remember and much harder to guess than "M@ng0". A passphrase of three or four random words is a good habit.

Never store plain passwords

A website must check your password at login, but it must never keep the password itself. If the database is ever stolen, plain passwords would be exposed. Instead the site stores a hash. A hash is a fixed-length fingerprint made from the text. The same text always gives the same hash, but you cannot turn the hash back into the text.

python

import hashlib

fingerprint = hashlib.sha256("Mango@2026".encode()).hexdigest()
print(fingerprint)
print(len(fingerprint))  # always 64 hex characters
print(hashlib.sha256("mango@2026".encode()).hexdigest() == fingerprint)  # False: one letter changed

.encode() turns the text into bytes, which hashlib needs.

Careful: SHA-256 is too FAST for passwords: an attacker can try billions of guesses per second. Real sites use slow password hashes such as bcrypt or Argon2, with a random salt (extra random text) for each user. Do not build your own login system for real users; use a well-tested library or framework.

Step 3: test it

An empty string should be weak with all five reasons.
"Mango@2026" meets all five rules but is under 12 characters: score 5, strong.
A common password like "Password" (any case) should be weak.
A long phrase with spaces: spaces are not counted as symbols.

Project: password strength checker

Explanation

The plan

The rules

Step 1: test each rule

Step 2: score, label and reasons

Never store plain passwords

Step 3: test it

Watch the lesson

In real life: A sign-up form for a college fest

Practice (0/3 done)

Quick quiz

Read more (free)