DEV Community: Magnifique numérique

Checking password strength using the zxcvbn library

Magnifique numérique — Thu, 04 Jun 2026 08:46:53 +0000

Greetings to everyone! In this article, we will check password security using the zxcvbn library, which determines password strength and helps improve it.

Installing the library

Windows:

pip install zxcvbn

MacOS:

pip3 install zxcvbn

Linux:

pip install zxcvbn

Checking a Strong Password

I suggest generating a random password using the module we developed in an earlier article. Thus, here is the code to generate a random password of 15 characters of any type (letters, numbers, special characters):

manager = Password()
password = manager.generate(15, "all")

print(password)

We get the following password:

2Ub!{V%kr=B(qhI

Checking password strength

So, to obtain all data regarding password strength, the zxcvbn() function is used, which provides all information about our password. Now, let's pass our password to the zxcvbn() function and print the result:

protection_report = zxcvbn.zxcvbn("2Ub!{V%kr=B(qhI")
print(protection_report)

Output:

{'password': '2Ub!{V%kr=B(qhI', 'guesses': Decimal('1000000000000001'), 'guesses_log10': 14.999999999999998, 'sequence': [{'pattern': 'bruteforce', 'token': '2Ub!{V%kr=B(qhI', 'i': 0, 'j': 14, 'guesses': 1000000000000000, 'guesses_log10': 14.999999999999998}], 'calc_time': datetime.timedelta(microseconds=2999), 'crack_times_seconds': {'online_throttling_100_per_hour': Decimal('36000000000000037.99840144433'), 'online_no_throttling_10_per_second': Decimal('100000000000000.1'), 'offline_slow_hashing_1e4_per_second': Decimal('100000000000.0001'), 'offline_fast_hashing_1e10_per_second': Decimal('100000.0000000001')}, 'crack_times_display': {'online_throttling_100_per_hour': 'centuries', 'online_no_throttling_10_per_second': 'centuries', 'offline_slow_hashing_1e4_per_second': 'centuries', 'offline_fast_hashing_1e10_per_second': '1 day'}, 'score': 4, 'feedback': {'warning': '', 'suggestions': []}}

As a result, we received a dictionary with truly rich content, which shows us various aspects of password strength. Below, I have defined each key for a deeper understanding.

About the ‘password’ key

The password we passed to the function.

About the ‘guesses’ key

The number of attempts required to guess the password.

About the ‘guesses_log10’ key

Converts the number of guesses in the ‘guesses’ key into a more convenient format from 1 to 15.

About the ‘pattern’ key

This is sort of the password template type. In this case, it says ‘bruteforce’ because our password is a set of random characters.

About the ‘token’ key

This is the part of our password that matches the pattern.

About the ‘i’ and ‘j’ keys

During the password check, the program verifies the password by determining its pattern by separate parts precisely thanks to these indices. Key ‘i’ is the start, and ‘j’ is the end.
For example, if our password contains a name and a birth year, the program will understand via these indices that the first part is a name (by pattern), and the second is a birth year (this will be a different pattern).

About the ‘calc_time’ key

The time it took our processor to execute the zxcvbn() function.

About the ‘score’ key

Password strength score. The password is rated from 0 to 4. That is, in this case, our password is maximally secure.

About the ‘feedback’ key

Here we can see warnings regarding password strength (‘warning’) and options for improving it (‘suggestions’).

Separately about the keys crack_times_seconds and crack_times_display

I also consider it necessary to describe these keys in a separate part of the article:

'crack_times_seconds': {'online_throttling_100_per_hour': Decimal('36000000000000037.99840144433'), 'online_no_throttling_10_per_second': Decimal('100000000000000.1'), 'offline_slow_hashing_1e4_per_second': Decimal('100000000000.0001'), 'offline_fast_hashing_1e10_per_second': Decimal('100000.0000000001')}, 'crack_times_display': {'online_throttling_100_per_hour': 'centuries', 'online_no_throttling_10_per_second': 'centuries', 'offline_slow_hashing_1e4_per_second': 'centuries', 'offline_fast_hashing_1e10_per_second': '1 day'},

Here, possible attack types for cracking the password are shown, along with the time a fraudster would spend on each of these types. The key 'crack_times_seconds' shows this time in seconds, and 'crack_times_display' shows it in a format more familiar to us: days, months, years, etc.
I suggest considering the context of each of these types for better understanding.

The first type ('online_throttling_100_per_hour') is a situation where a fraudster tries to guess your password via a site (meaning online), with their limit being 100 attempts per hour. The fraudster visits the site just like all other users. This type has limitations because, after several failed attempts, the site will start enabling bot protection.

The second type ('online_no_throttling_10_per_second') is a situation where a fraudster also guesses the password, but with a limit of 10 attempts per second. Here the fraudster sends requests directly to the server, so there are fewer restrictions.

The third type ('offline_slow_hashing_1e4_per_second') is a situation where the fraudster has a database of passwords (meaning this attack is no longer online), but the passwords are protected by a reliable algorithm.

The fourth type ('offline_fast_hashing_1e10_per_second') is a situation where the fraudster has a database of passwords, but they are protected by an unreliable algorithm. And obviously, the password will be easily cracked then, even if it is generally reliable.

Checking the security of a weak password

Now let’s try applying the zxcvbn() function to a weak password to see the conclusion about it:

protection_report = zxcvbn.zxcvbn("qwerty")
print(protection_report)

Here is the information we received about it:

{'password': 'qwerty', 'guesses': Decimal('5'), 'guesses_log10': 0.6989700043360187, 'sequence': [{'pattern': 'dictionary', 'i': 0, 'j': 5, 'token': 'qwerty', 'matched_word': 'qwerty', 'rank': 4, 'dictionary_name': 'passwords', 'reversed': False, 'l33t': False, 'base_guesses': 4, 'uppercase_variations': 1, 'l33t_variations': 1, 'guesses': 4, 'guesses_log10': 0.6020599913279623}], 'calc_time': datetime.timedelta(microseconds=109428), 'crack_times_seconds': {'online_throttling_100_per_hour': Decimal('180.0000000000000099920072216'), 'online_no_throttling_10_per_second': Decimal('0.5'), 'offline_slow_hashing_1e4_per_second': Decimal('0.0005'), 'offline_fast_hashing_1e10_per_second': Decimal('5E-10')}, 'crack_times_display': {'online_throttling_100_per_hour': '3 minutes', 'online_no_throttling_10_per_second': 'less than a second', 'offline_slow_hashing_1e4_per_second': 'less than a second', 'offline_fast_hashing_1e10_per_second': 'less than a second'}, 'score': 0, 'feedback': {'warning': 'This is a top-10 common password.', 'suggestions': ['Add another word or two. Uncommon words are better.']}}

As we can see, all aspects of the password clearly give us the understanding that it is unreliable. Furthermore, we can see some new keys in the dictionary, which also have their own meaning.
The meaning of the new keys can be seen in the table below.

About the ‘matched_word’ key

This is the word from the dictionary that matches our password.

About the ‘rank’ key

The place this password occupies in the list of popular passwords.

About the ‘dictionary_name’ key

Shows the name of the dictionary where the password was directly found.

About the ‘reversed’ key

Checks if the password is written backwards.

About the ‘l33t’ key

Checks if there are no letter-to-number or symbol substitutions in the password. This can often be seen in various passwords.
For example, instead of password, it might be written as pa$$word.

About the ‘base_guesses’ key

The base number of attempts required to guess the password if it contained no changes.

About the ‘uppercase_variations’ key

Determines the complexity level of the password if it contains uppercase letters.

About the ‘l33t_variations’ key

Determines the complexity level of the password if it replaced letters with numbers or symbols.

It is also worth remembering that we can simply select specific values via keys, rather than outputting all information about the password completely. For example, here we output recommendations for improving the password:

protection_report = zxcvbn.zxcvbn("qwerty")
print(protection_report["feedback"])

Output:

{'warning': 'This is a top-10 common password.', 'suggestions': ['Add another word or two. Uncommon words are better.']}

Conclusion

So, in this article, we reviewed the zxcvbn() library, which allows for fully checking passwords for their reliability thanks to a wide spectrum of possible check types. We also compared the conclusions for a strong and a weak password. Thank you all for your attention!

Converting the graphs into scientific styles

Magnifique numérique — Sat, 24 Jan 2026 11:46:36 +0000

Hi everyone! In this article, we consider the SciencePlots library that allows us convert simple graphs into a scientific format. In this format, the graphs are displayed in some types of scientific articles.

Initial actions

Installing

Before using the SciencePlots library, we need to install it with the help of the commands according to your operating system.
Windows:

pip install SciencePlots

MacOS:

pip3 install SciencePlots

Linux:

pip install SciencePlots

Also, we need to install the matplotlib library to create graphs. Commands to install the library are available below.
Windows:

pip install matplotlib

MacOS:

pip3 install matplotlib

Linux:

pip install matplotlib

Preparing the data and writing the code

Import the libraries:

import scienceplots
import matplotlib.pyplot as plt

As data, we take our information about Bitcoin’s worth in 2025:

bitcoin_prices = [102405.03, 84373.01, 82548.91, 94207.31, 104638.09, 107135.34, 115758.20, 108236.71, 114056.08,                      109556.16, 90394.31, 87263.99]

bitcoin_prices_labels = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"]

The next step is to create our graph:

plt.plot(bitcoin_prices_labels, bitcoin_prices)
plt.title("Bitcoin prices in 2025")

plt.xlabel("Months")
plt.ylabel("Real prices ($)")
plt.show()

Here’s the full code; however, it will be the function called simple_graph():

import scienceplots
import matplotlib.pyplot as plt


def simple_graph():
    bitcoin_prices = [102405.03, 84373.01, 82548.91, 94207.31, 104638.09, 107135.34, 115758.20, 108236.71, 114056.08,
                      109556.16, 90394.31, 87263.99]

    bitcoin_prices_labels = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul",  "Aug", "Sep", "Oct", "Nov", "Dec"]

    plt.plot(bitcoin_prices_labels, bitcoin_prices)
    plt.title("Bitcoin prices in 2025")

    plt.xlabel("Months")
    plt.ylabel("Real prices ($)")
    plt.show()


simple_graph()

Now run the code in a way that we can see the graph without any styles:

Base styles

Science style

So, firstly, we consider the science style, but without a LaTeX font. To set the style, we need to define the style as the main style of our graph. We can do it with the help of the style package and use the use() function.
Here’s the code example, where we set the styles:

plt.style.use(["science", "no-latex"])

In the use() function, we define one or more styles, which are sets of visual attributes for graph elements. If we combine multiple styles in a single graph, we need to specify them as a list.
So, our current code looks like this:

import scienceplots
import matplotlib.pyplot as plt


def simple_graph():
    plt.style.use(["science", "no-latex"])

    bitcoin_prices = [102405.03, 84373.01, 82548.91, 94207.31, 104638.09, 107135.34, 115758.20, 108236.71, 114056.08, 109556.16, 90394.31, 87263.99]

    bitcoin_prices_labels = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"]

    plt.plot(bitcoin_prices_labels, bitcoin_prices)
    plt.title("Bitcoin prices in 2025")

    plt.xlabel("Months")
    plt.ylabel("Real prices ($)")
    plt.show()


simple_graph()

Run the code:

IEEE style

The style makes the graph only with black and white colours.
Set the style:

plt.style.use(["ieee", "no-latex"])

Also, we should make one crucial change when we use the IEEE style. The style didn’t work correctly only with the common show() function, and that’s why we need to write the code:

plt.rcParams.update(
        {"figure.dpi": "100"}
)

The code helps us to correctly set the graph settings. Without these settings, we can get the graph in an inappropriate, enormous size. Overall, the IEEE format was developed specifically for scientific magazines, and that’s the reason why the graphs are created in a tiny size. The development environment tries to resize the graphs, and as a result, we got enormous graphs.
But if we define the DPI as 100 (Dots Per Inch), the graph will convert into a larger quantity of pixels, which makes the image’s quality much better.
So, in the result, we’ll get the graph:

Notebook style

The style is used by the Jupyter Notebook.
Set the style:

plt.style.use(["notebook"])

We’ll get such a format:

Nature style

The style is used by the Nature scientific magazine.
Set the style in code:

plt.style.use(["nature"])

That’s the result:

Grid style

The grid style adds the grid to our graph.
Set the style in code:

plt.style.use(["grid"])

That’s why we get this graph:

Style mixing

Science + no-latex + grid styles

An example of how to mix different styles, such as science and no-latex, with a grid, can be seen below:

plt.style.use(["science", "no-latex", "grid"])

As we can see, we just changed only one row and added the grid style to another two.
Our graph will look like this:

Science + no-latex + notebook styles

Just add the third style in code:

plt.style.use(["science", "no-latex", "notebook"])

So, we’ll see the result:

Science + no-latex + nature styles

Change the styles in code:

plt.style.use(["science", "no-latex", "nature"])

The result:

Science + no-latex + ieee styles

Add the IEEE style to our current ones:

plt.style.use(["science", "no-latex", "ieee"])

In the next step, we need to clearly define the font that our graph style will use. The problem is that the IEEE style uses only Times New Roman font, but the program will search for the font called Times, which isn’t the full name of the font. We’ve got an error because we don’t have a font with the same name.
To exit from the situation, we need to clearly define that we will search for Times New Roman instead of Times.
That’s why we define the font:

plt.rcParams.update(
        {
            "font.family": "serif",
            "font.serif": "Times New Roman",
            "figure.dpi": "100",
        }
    )

Run the code:

Conclusion

In this article, we learned how to change and add some specific styles for the matplotlib graphs. So, now we know why we need to use certain styles and how to use them in code. Thanks for your attention!

Used resources

(n. d.). Bitcoin USD ( BTC-USD) — Price History. Digrin. https://www.digrin.com/stocks/detail/BTC-USD/price