- Get Connected
- Student FAQ
- What is “hacking?”
- What is a CTF?
- What is picoCTF?
- What will students need to know?
- What software do students need?
- As a college student / non-student, can I play too?
- How much time should I allocate? Do students have to work at particular times?
- Do student compete individually or in teams?
- Is there informational material I can use to advertise this at my school?
- Register your account for picoCTF 2019. You will receive a confirmation email with an account activation link.
- Activate your account via the confirmation email.
- Log in to your account and create or join a team. You may also choose to ‘Play as an
Individual’ and join or create a team , but be aware that you may only join or create a
team once! Share your
Team Passwordwith your desired teammates.
- If your teacher has created a classroom, join the classroom with the
Teacher Usernameto help them track your progress.
Teams may consist of 1-5 players, and may consist of players at different schools. To be eligible for prizes during competition period, all players on a team must be eligible. See the rules on eligibility. If an ineligible player joins your team, the team will become ineligible. By default, teams are locked to prevent this from happening inadvertently. You can see your team composition on the Profile page.
School Name /
Organization Name automatically is assigned to what the team creator
chose at their account registration. This name may not be changed. If your team is eligible for
any scoreboards (such as US Middle/High School students), this
School Name /
will appear alongside your team name on the scoreboard.
Team members share the same problem instances, problem solving progress, and scores. (Yes, that does mean that different teams have different problem instances—the same problem will have different answer flags from team to team!)
You may join a team, create a team, or see your current team’s members and reset the team password in your Profile page.
Teachers can create a classroom to track statistics of students’ progress. Classrooms may have multiple teachers and will feature its own scoreboard in addition to the public scoreboards.
Joining a Classroom
Through the classroom management interface, students and student teams may join classrooms by entering
Classroom Name and
Teacher Username in their Profile page. Because problem solving
progression is shared by team members, by joining a class you are allowing the classroom teacher(s)
to see the usernames and progress of everyone in your team. It is possible to join multiple classrooms—
for example, a classroom representing your student club, a classroom representing your computer science
class, as well as a classroom representing your entire high school or school district.
Leaving a Classroom
Users can leave a classroom by clicking the X button next to the entry in their Classroom list on the Profile page.
For help with challenge problems and the platform, create an account on
Piazza. Register with access key
We have started a community Discord server. This server is intended for general conversation around picoCTF, team recruitment for competitors, discussion about picoCTF open-source development, or casual chat. This server is not intended for challenge problem help, and will not be monitored by problem developers. Please use Piazza for that purpose.
What is “hacking?”
Hacking is all about curiosity, exploration, and deeply understanding how something works. Most people who identify as “hackers” are working very hard to protect people and to make technology easier and safer to use. Unfortunately, when most people hear or read about hacking in the news, the story is about people using hacking to do harm, but this couldn’t be further from the truth. Career-wise, people skilled in hacking are highly sought out by companies looking to strengthen their cybersecurity. Computer security experts are in very high demand today, and often are paid six-figure salaries.
What is a CTF?
CTFs (short for capture the flag) are a type of computer security competition. Contestants are presented with a set of challenges which test their creativity, technical (and googling) skills, and problem-solving ability. Challenges usually cover a number of categories, and when solved, each yields a string (called a flag) which is submitted to an online scoring service. CTFs are a great way to learn a wide array of computer security skills in a safe, legal environment, and are hosted and played by many security groups around the world for fun and practice.
What is picoCTF?
There exist several other well-established highschool computer security competitions, including Cyberpatriot and US Cyber Challenge. These competitions focus primarily on systems administration fundamentals, which are very useful and marketable skills. However, we believe the proper purpose of a high school computer security competition is not only to teach valuable skills, but also to get students interested in and excited about computer science. Defensive competitions are often laborious affairs, and come down to running checklists and executing config scripts. Offense, on the other hand, is heavily focused on exploration and improvisation, and often has elements of play. We believe a competition touching on the offensive elements of computer security is therefore a better vehicle for ‘tech evangelism’ to students in American high schools. Further, we believe that an understanding of offensive techniques is essential for mounting an effective defense, and that the tools-and-configuration focus encountered in defensive competitions does not lead students to ‘know their enemy’ as effectively as teaching them to actively think like an attacker.
picoCTF is an offensively-oriented highschool computer security competition that seeks to generate interest in computer science among highschoolers: teaching them enough about computer security to pique their curiosity, motivating them to explore on their own, and enabling them to better defend their machines.
The name of the competition follows the Plaid Parliament of Pwning’s running tradition of using the letter P wherever possible.
Please see our External Resources page for links to related competitions and programs.
What will students need to know?
What software do students need?
The competition can be done with just a web browser, but an SSH client (e.g. putty) can be helpful. Students are free to use other tools as well.
School network administrators may need to approve access or request pages/sites to whitelist for picoCTF.
Minimum Access Requirements
HTTP(S) site whitelist for:
- HTTP(S) site whitelist for
- SSH (port 22) access for
- Unrestricted access to all ports on
Reverse Proxy for 2018 problems
We have added a HTTPS reverse proxy for better access to web challenge problems on
Currently they are provisioned on numerous random, non-standard ports (e.g.
Understandably, this may be difficult for users on restricted-access school networks that need explicit whitelisting.
To use the reverse proxy, modify the URL so that the port number is appended to the end of
In the above example,
As a college student / non-student, can I play too?
Absolutely! Everyone is welcome. Only US middle and high school students are eligible for prizes, but we encourage teachers (and others!) to play.
How much time should I allocate? Do students have to work at particular times?
We plan to have a range of challenge difficulties. Students will be able to log in at any time and spend as much or as little time as they like during the two weeks. We also expect to keep the site running after the competition so students can continue learning after the competition is over.
Do student compete individually or in teams?
Each student will register individually. Afterwards, they can compete individually or form teams of up to 5 members.