Step 53. pip and Virtual Environments — How to Bring the World’s Tools into Your Room

Level 1 — Programming and the Computer’s Insides | Difficulty ★★☆☆☆ | Estimated time: 3 hours

Prerequisites: Steps 41–52 complete. You know basic Python syntax and the standard library (Step 51). Today’s practice requires an internet connection.

What you need: a PC with Python installed, PowerShell, an internet connection.
Caution: starting today, you install code made by others onto your computer. So one new rule applies — check the spelling of package names exactly, and install only famous ones. The requests package we install today is one of the most widely used Python packages in the world.

In Step 51 we used the standard library, the built-in toolbox. But Python’s real power lies outside it. Hundreds of thousands of external tools uploaded by developers around the world — requests, which does a web request in two lines; openpyxl, which handles Excel; scapy, which touches network packets. The key that opens this bonus box is today’s protagonist, pip.

But installing recklessly causes problems. If project A requires version 1.0 of some tool and project B requires 2.0, you can’t install both on one computer at the same time — they collide. So the technique of making a small independent room for each project and installing only inside it is the virtual environment. Today you learn the whole system for using external tools: the key (pip), the room (virtual environment), and the room’s ingredient list (requirements.txt).

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain what pip and PyPI are, and what a dependency is
Create, turn on (activate), and turn off a virtual environment (venv)
Install the external package requests and fetch a web page in two lines
Record a package list with requirements.txt and explain its purpose
"Break and fix" an environment by uninstalling and reinstalling a package

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Python 3.12 + PowerShell. Internet connection required
Today’s commands	`python -m venv venv` (make the room), `.\venv\Scripts\Activate.ps1` (turn on), `pip install / list / freeze / show / uninstall`, `deactivate` (turn off)
Concepts needed	pip and PyPI, dependencies, virtual environments, requirements.txt

2-1. pip — Python’s App Store

pip is the manager that finds, installs, and removes Python packages (bundles of tools made by others). It fetches them from a giant public repository called PyPI (Python Package Index) (pypi.org). A single line, pip install requests, finds requests in the repository and installs it on your computer. It’s the same place as a smartphone’s app store.

2-2. Dependencies — Tools of Tools

An installed package often needs other packages. This relationship is called a dependency. pip installs dependencies automatically along with the package. Convenient — but when versions tangle, you get situations where "it works in this project but not in that one."

2-3. Virtual Environments — An Independent Room per Project

What blocks that tangling at the source is the virtual environment. You make one independent space inside the project folder containing a Python executable and packages, and install only inside it. Each room can hold a different version of a tool, so collisions disappear. You make it with the venv module included with Python by default.

2-4. requirements.txt — The Ingredient List

A list file recording "what must be installed in this project," together with versions. With just this file, one line — pip install -r requirements.txt — reproduces the exact same environment on another computer. It’s the standard convention for collaboration and moving (to a new computer).

3. Follow Along

Today’s practice happens in PowerShell. Start from your project folder (security-study).

3-1. Checking pip’s Status

pip --version

pip 25.0.1 from C:\...\venv\Lib\site-packages\pip (python 3.12)

(Measured 2026-09-09. The version number may differ.)

How to read the output: if you can see pip’s version and location, you’re ready. If you get an error, recheck the Python installation steps (environment variables) in Step 41.

3-2. Creating a Virtual Environment

python -m venv venv

(ends quietly with no output)

(Measured 2026-09-09. It may take a few dozen seconds.)

How to read the output: python -m venv means "Python, run the venv module," and the venv after it is the name of the room to create (by convention it’s named venv). When it finishes, a new folder called venv appears inside your folder. Open it in File Explorer and it looks like this (measured 2026-09-09):

venv\
 ├─ Include\
 ├─ Lib\
 ├─ Scripts\        ← python.exe, pip.exe, and Activate.ps1 live here
 └─ pyvenv.cfg

Ending quietly is normal. This is our independent room.

3-3. Turning the Virtual Environment On (Activation)

.\venv\Scripts\Activate.ps1

(venv) PS C:\Users\Lee\Desktop\security-study>

How to read the output: when (venv) appears at the very front of the prompt, you’re inside the room. Everything you install in this state piles up only inside this room. When you want to turn it off, type deactivate.

Wall alert: many people get a red error (execution policy) here. If you get an error, read Wall 1 in section 6 below first, then come back.

Why: the habit of checking "is it on?" by the prompt is half of using virtual environments.

3-4. Installing requests and Your First Web Request

With the virtual environment on:

pip install requests

Collecting requests
...
Installing collected packages: urllib3, idna, charset_normalizer, certifi, requests
Successfully installed certifi-2026.7.22 charset_normalizer-3.5.1 idna-3.19 requests-2.34.2 urllib3-2.7.0

(Measured 2026-09-09. Versions vary from day to day.)

How to read the output: you ordered one package, requests, but five got installed. The other four are dependencies — the tools requests needs, which pip installed along with it automatically.

Now create fetch.py:

import requests

r = requests.get("https://example.com")
print("Status code:", r.status_code)
print("First 80 characters of the body:")
print(r.text[:80])

Status code: 200
First 80 characters of the body:
<!doctype html><html lang="en"><head><title>Example Domain</title><link rel="ico

(Measured 2026-09-09.)

How to read the output: status code 200 is the web’s answer meaning "success" (that number you saw in Step 34). You fetched a web page in just three lines. With the standard library alone, this job takes dozens of lines.

Why: tools that talk to the web are a basic skill for information gathering, API use, and CTF web problems.

3-5. Making the Installed List and the Ingredient List

pip list
pip freeze > requirements.txt

Package            Version
------------------ ---------
certifi            2026.7.22
charset-normalizer 3.5.1
idna               3.19
pip                25.0.1
requests           2.34.2
urllib3            2.7.0

(Measured 2026-09-09.)

Open the generated requirements.txt in Notepad:

certifi==2026.7.22
charset-normalizer==3.5.1
idna==3.19
requests==2.34.2
urllib3==2.7.0

(Measured 2026-09-09.)

How to read the output: pip list shows what’s installed in the room, and pip freeze prints that list in the "ingredient list with versions" format (name==version). We saved it to a file with >.

Predict: with this file, what happens with the single line pip install -r requirements.txt in a new virtual environment? The answer: "the same environment is reproduced in its entirety."

3-6. Turning the Virtual Environment Off and Coming Back

deactivate

How to read it: (venv) disappears from the prompt. You’ve come out of the room. To go back in, type the Activate command from 3-3 again. The room isn’t deleted — it stays as it is.

3-7. Package Info and Uninstalling — Break It and Fix It

Let’s check the ID card of the installed package, delete it, and install it again. With the virtual environment on:

pip show requests

Name: requests
Version: 2.34.2
Summary: Python HTTP for Humans.
Author-email: Kenneth Reitz <me@kennethreitz.org>
...

(Measured 2026-09-09.)

Now delete it, as an experiment:

pip uninstall requests

It shows the list to delete and asks Proceed (Y/n)? — press Y:

Uninstalling requests-2.34.2:
  Successfully uninstalled requests-2.34.2

In this state, run python fetch.py:

ModuleNotFoundError: No module named 'requests'

(Measured 2026-09-09. We verified everything: uninstall → error → recovery by reinstalling.)

How to read it: with requests gone, dying at the import is only natural. Reinstall with pip install requests and it recovers. This "break it and fix it" is the fastest training for handling environments. An environment is not something to touch timidly — it’s something you can remake anytime.

4. Missions & Exercises

Mission — Setting Up Your Own Tool Room

Create a virtual environment in the security-study folder and turn it on
Install requests, and write check_site.py, which prints three things: the status code, the response size (len(r.text)), and the response time (r.elapsed)
Receive the address to check as an argument (sys.argv, Step 51 review). Usage: python check_site.py https://example.com
Create requirements.txt and copy its contents into your notes
Practice turning the virtual environment off and on twice — confirm it’s on by the (venv) in the prompt

Try checking three or more places, changing the address. However, limit what you check to test sites like example.com or pages you made yourself.

Exercises

Q1. A single pip install requests installed five packages. What are the other four, and why does pip install them together?

Q2. How can you tell at a glance whether a virtual environment is on, and what problem occurs if you install without turning it on?

Q3. In requirements.txt’s requests==2.34.2, what does == mean, and how does this file make "environment moving" possible?

Q4. When moving a project to another computer, why don’t you copy the whole venv folder? What do you move instead, and in what order do you restore it on the new computer?

5. Model Answers & Completion Criteria

Mission Model Answer

check_site.py:

import sys
import requests

if len(sys.argv) < 2:
    print("Usage: python check_site.py <address>")
    sys.exit(1)

url = sys.argv[1]
try:
    r = requests.get(url, timeout=10)
except requests.exceptions.RequestException as e:
    print("Connection failed:", e)
    sys.exit(1)

print("Address:", url)
print("Status code:", r.status_code)
print("Response size:", len(r.text), "characters")
print("Response time:", r.elapsed)

How to verify: ① With (venv) visible, does python check_site.py https://example.com print status code 200? ② Does running with no argument print the usage? ③ Given a wrong address ("htp://…"), does it print "Connection failed" instead of dying? ④ After pip freeze > requirements.txt, are requests and its dependencies written in the file with versions? timeout=10 is a safety device meaning "give up if there’s no answer for over 10 seconds" — basic courtesy in web request code.

Exercise Solutions

Q1 solution. They’re dependencies — the tools requests uses internally (certifi, charset-normalizer, idna, urllib3). pip reads the package’s "I need these" information and installs dependencies automatically along with it (confirmed in the 2026-09-09 measured output).

Q2 solution. You know by the (venv) marker at the very front of the prompt. If you install without turning it on, it gets installed globally across the whole computer, causing collisions when different projects need different versions. "Check the prompt before installing" must be a habit.

Q3 solution. It’s a pinning marker meaning "exactly this version." With this file and pip install -r requirements.txt, you can install the same versions as-is on any computer and reproduce the environment. Moving only the code and reproducing the environment from a recipe is the standard convention.

Q4 solution. Because the venv folder is large, can be remade anytime, and can’t even be used wholesale if the operating system differs. The only baggage to move is the code and requirements.txt. On the new computer: ① create the room with python -m venv venv → ② activate → ③ reproduce with pip install -r requirements.txt. Three lines and it’s done.

Completion Criteria Checklist

[ ] I can explain what pip, PyPI, and dependencies are
[ ] I can create a virtual environment with python -m venv venv
[ ] I can activate/deactivate and check the state by the (venv) marker
[ ] I installed requests and succeeded at a web request
[ ] I can create requirements.txt and explain its purpose
[ ] I did the break-and-fix: uninstall → confirm error → reinstall
[ ] Mission: I finished check_site.py and the room setup

6. Common Pitfalls & Fixes

Wall 1. A red execution policy error at Activate.ps1

Symptom: a red error saying "running scripts is disabled on this system…" (a typical message example):

...Activate.ps1 cannot be loaded because running scripts is disabled on this system...

Cause: PowerShell’s default security policy is blocking script execution. PowerShell is locked by default to prevent scripts from being run by just anyone.
Fix: type Set-ExecutionPolicy RemoteSigned -Scope CurrentUser into PowerShell and answer Y. It’s a setting that "allows local scripts on my computer," applied only to the current user. Then run Activate again. (Note: in the Command Prompt (cmd), you can turn it on without any policy using venv\Scripts\activate.bat.)

Wall 2. It installed, but the import doesn’t work

Symptom: pip install succeeded, but the script raises ModuleNotFoundError: No module named 'requests' (reproduced in the 2026-09-09 measurement).
Cause: the place you installed differs from the place you’re running. The typical case: you installed into the virtual environment but ran with the Python outside it.
Fix: check that (venv) is in the prompt, and run with python fetch.py in that state. If you use an editor, you must also point the editor’s Python interpreter to the one inside venv.

Wall 3. Installing recklessly into the global environment

Symptom: everything was installed across the whole computer with no virtual environment, and versions tangle between projects later.
Cause: habit. At first making a room looks bothersome, so you skip it.
Fix: memorize "new project = new venv" like a formula. Making one new room is always faster than untangling a tangled environment. If a venv folder goes bad, you just delete it.

Wall 4. Lots of red text during installation and it fails

Symptom: the installation fails with a long error.
Cause: a network problem, a firewall, or a typo in the package name.
Fix: read the last line of the error. Could not find a version... means a name typo (typing requets instead of requests is common); a connection-related message means check the network.

Wall 5. pip can’t find python / or python doesn’t know pip

Symptom: pip works but python doesn’t, or vice versa.
Cause: the two are pointing to different Python installations. Common when multiple Pythons are installed on one computer.
Fix: use the form python -m pip install requests. It means "with this python’s pip," so the two can’t mismatch. Especially inside a virtual environment, this form is the most certain.

7. Summary

Today’s Concepts

Concept	One-line description
pip	The manager that installs and removes packages from the PyPI repository
PyPI	The public repository of the world’s Python packages
Dependency	Another package that a package needs
Virtual environment (venv)	An independent install space per project — blocks version collisions
requirements.txt	The ingredient list with versions — the key to reproducing an environment

Today’s Commands

Command	What it does
`python -m venv venv`	Create a virtual environment
`.\venv\Scripts\Activate.ps1`	Turn on a virtual environment (PowerShell)
`deactivate`	Turn off a virtual environment
`pip install package`	Install (including dependencies)
`pip list` / `pip show package`	List / check the ID card
`pip freeze > requirements.txt`	Record the ingredient list
`pip install -r requirements.txt`	Reproduce an environment from the list
`pip uninstall package`	Remove

The Instinct That Matters More Than Commands

Organized as a flow, today’s commands are six lines. Make a room (python -m venv venv), enter it (Activate), install (pip install), leave the list (pip freeze > requirements.txt), come out (deactivate), and elsewhere reproduce from the list (pip install -r requirements.txt). These six lines are the cycle Python developers run every day.

Remember two more things. First, pip install is "installing code made by someone else so it can run on my computer." The repository also hosts fakes with spellings similar to famous packages (typosquatting malware). Check the spelling of names, pick famous ones with many downloads, ignore "try installing this" from unknown sources — the moment you install a tool is the moment you grant trust. Second, make a SETUP.md in your project folder and write down what you did today — including "I got an execution policy error and solved it like this." What saves you two months from now is not memory but records.

Once every box is checked, Step 53 is complete. Click the checkbox in the sidebar to save your progress.