🕵️‍♀️ Secret Code School

For thousands of years, people have used ciphers to hide information. A cipher is just a set of rules for scrambling a message. One of the oldest and simplest is the Caesar Cipher, named after Julius Caesar himself! All he did was shift each letter of the alphabet forward by a certain number of places. If the "key" was 3, 'A' would become 'D', 'B' would become 'E', and so on. Simple, but super effective for its time!

A Caesar Cipher is fun, but a modern computer could crack it in less than a second! For real security, like protecting your passwords, we use something called hashing.

Imagine a magic blender. You can put anything in—a word, a sentence, or an entire book. You press "blend," and it gives you a short, unique code of random letters and numbers. That code is the "hash." Here's the magic part:
- The same input always creates the same hash. `password123` will always become the same jumble. - But change one tiny thing (`password124`), and you get a completely different jumble. - Most importantly, you can't un-blend it! You can't take the hash and figure out what the original message was. It's a one-way street.

So, how does this "magic blender" protect your real accounts on sites like Roblox or TomorrowHub? When you create an account, the website doesn't store your actual password. That would be too risky! Instead, it runs your password through a hash function and stores the hash.

When you log in, it takes the password you just typed, hashes it, and compares that new hash to the one it has stored. If they match, you're in! If a hacker ever steals the database, all they get is a list of hashes, not your actual passwords. But... even that can be dangerous if people use common passwords. Let's see why.

import hashlib

# A dictionary pretending to be our user database
# The password for 'pan' is 'neverland_rules'
user_database = {
    "pan": "a516ba2084c88344e11c5914afd31d5a714c62e5"
}

def check_password(username, password_attempt):
    # Get the stored hash for the user
    stored_hash = user_database.get(username)
    if not stored_hash:
        return "❌ User not found!"

    # Hash the password attempt using the same algorithm (sha1)
    attempted_hash = hashlib.sha1(password_attempt.encode()).hexdigest()

    # Compare the hashes!
    if attempted_hash == stored_hash:
        return "✅ Access Granted! Welcome, " + username
    else:
        return "❌ Access Denied! Wrong password."

# Let's test it!
print(check_password("pan", "neverland_rules")) # This will work!
print(check_password("pan", "wrongpassword"))   # This will fail!