How to play
Guess today's password in 6 tries. It is a real password, one of the most common ones in the breach data — that is what makes it deducible instead of a lottery.
Every guess must be exactly as long as the password. The keyboard below carries every character a password in this game can contain — letters in both cases, digits and the symbols that actually turn up in leaked passwords. Anything else is ignored, whether you tap it or type it.
Characters you have already placed stay locked in the next rows, so you never retype them: typing fills the positions that are still open. Characters you have ruled out go dead — the key is disabled here, and on a physical keyboard it is refused with a note saying why.
Each cell tells you two things
The background is about the character. The border is about its kind: uppercase letter, lowercase letter, digit or symbol.
- P right character, right position
- a that character is somewhere else
- z that character is not in the password — or you have already used up every occurrence of it
- ! wrong character, but the right kind for that position
- 3 both at once: that character is elsewhere, and this position takes that kind
On a right character the border stays plain and tells you nothing — the kind came with the character. Everywhere else, a plain border means the kind is wrong too. The game never tells you which kind is right: with only four, that would hand you the whole shape after two guesses.
Case matters
i and I are different characters. A greyed-out L does
not rule out l. This is not Wordle: you are guessing a password, not a word.
Word found
When your guess has the word the password is built on in the right place — spelled exactly as the password spells it, leet included — the game says so and tells you what the rest is made of. From there it is about the mangling, not the word.
Hints
Three of them, and none costs you a try. The only cost is a 💡 next to your score when you share.
The pool ships with the page
The password list is in your browser, obfuscated but not encrypted in any meaningful sense. Anyone who reads the source can work out tomorrow's puzzle — a secret held on the client is not a secret. That is the first lesson of this game, so I would rather say it than have you find out.