Ten levels, unlocked one at a time. Crack codes, decode secret signals, and outsmart a scammer — clear a level to reveal the next. Every puzzle has a tool built right in, so just play around until it clicks.
This intercepted message has had every letter shifted the same number of steps through the alphabet. Drag the slider until it turns back into real words.
This intercepted text is written in Base64, a common way to turn text into plain letters and numbers. Click the button as fast as you can to fill the decode bar and crack it open — but it drains if you slow down!
Every webpage is built from code your browser downloads but doesn't normally display. This page has a hidden note left in that code. Let's go find it.
One of these two emails is a real password-reset message. The other is a scam designed to steal a login. Click the one you think is fake.
Which of these two passwords would take a computer longer to guess?
This message crackled in over an old radio channel — dots and dashes only. Click Decode to translate the whole thing, punctuation included.
This transmission arrived as raw binary — just 1s and 0s. Every 8 digits is one character. Click Decode and let the computer do the counting.
Unscramble these letters to reveal a security term — something that filters traffic between a network and the internet. Type the word into the flag below, wrapped as CTF{...}.
One of these links leads to a real login page. The other is a look-alike scam domain built to steal a password. Click the fake one.
Which of these habits does the most to protect an account from being taken over?
Kids can play straight from this file — no setup, no internet needed. Runs fully offline in any browser. Reuse it for multiple groups: hit Reset between turns.
| # | Title | Answer |
|---|---|---|
| 1 | Cracked Code | Type-in flag: CTF{WELCOME_AGENT} (slider set to 1) |
| 2 | Encoded Transmission | Type-in flag: CTF{DECODED_SUCCESSFULLY} (appears after mashing the button to fill the bar to 100%) |
| 3 | Behind the Curtain | Type-in flag: CTF{VIEW_SOURCE_MASTER} |
| 4 | Spot the Fake | Click "Email A is the fake" |
| 5 | Strong or Weak? | Click "correct-horse-battery-42" |
| 6 | Secret Signal | Type-in flag: CTF{MORSE_CODE_MASTER} (appears after clicking Decode Signal) |
| 7 | Binary Whisper | Type-in flag: CTF{BINARY_BREAKTHROUGH} (appears after clicking Decode Binary) |
| 8 | Word Scramble | Type-in flag: CTF{FIREWALL} |
| 9 | Which Link is Legit? | Click the "arnaz0n.com" link (the one with a zero) |
| 10 | Lock It Down | Click "Turn on two-factor authentication (2FA)" |
Type-in flags are checked case-insensitively and ignore extra spaces. Click-to-answer levels (4, 5, 9, 10) give instant feedback and an explanation either way, no typing needed. Once a level is cleared it collapses into a short summary — there's a "Review" button on each to reopen it and see the content again.