From PEP 8:
_single_leading_underscore: weak "internal use" indicator. E.g.
from M import *
does not import objects whose name starts with an underscore.
single_trailing_underscore_: used by convention to avoid conflicts with Python keyword, e.g.
__double_leading_underscore: when naming a class attribute, invokes name mangling (inside class
_FooBar__boo; see below).
__double_leading_and_trailing_underscore__: "magic" objects or attributes that live in user-controlled namespaces. E.g.
__file__. Never invent such names; only use them as documented.
Also, from David Goodger's Code Like a Pythonista:
But try to avoid the
__privateform. I never use it. Trust me. If you use it, you WILL regret it later.
People coming from a C++/Java background are especially prone to overusing/misusing this "feature". But
__privatenames don't work the same way as in Java or C++. They just trigger a name mangling whose purpose is to prevent accidental namespace collisions in subclasses:
MyClass._MyClass__private. (Note that even this breaks down for subclasses with the same name as the superclass, e.g. subclasses in different modules.) It is possible to access
__privatenames from outside their class, just inconvenient and fragile (it adds a dependency on the exact name of the superclass).
The problem is that the author of a class may legitimately think "this attribute/method name should be private, only accessible from within this class definition" and use the
__privateconvention. But later on, a user of that class may make a subclass that legitimately needs access to that name. So either the superclass has to be modified (which may be difficult or impossible), or the subclass code has to use manually mangled names (which is ugly and fragile at best).
There's a concept in Python: "we're all consenting adults here". If you use the
__privateform, who are you protecting the attribute from? It's the responsibility of subclasses to use attributes from superclasses properly, and it's the responsibility of superclasses to document their attributes properly.
It's better to use the single-leading-underscore convention,
_internal. "This isn't name mangled at all; it just indicates to others to "be careful with this, it's an internal implementation detail; don't touch it if you don't fully understand it". It's only a convention though.
A single leading underscore is simply a convention that means, "You probably shouldn't use this." It doesn't do anything to stop someone from using the attribute.
A double leading underscore actually changes the name of the attribute so that two classes in an inheritance hierarchy can use the same attribute name, and they will not collide.