How to play
Guess today's password in 6 tries. It is a real password, one of the most common ones in the breach data — that is what makes it deducible instead of a lottery.
Every guess must be exactly as long as the password. You can use any key on the keyboard below — letters in both cases, digits and the symbols that actually turn up in leaked passwords. Anything else is ignored, whether you tap it or type it.
Each cell tells you two things
The background is about the character. The border is about its kind: uppercase letter, lowercase letter, digit or symbol.
- P right character, right position
- a that character is somewhere else
- z that character is not in the password
- ! wrong character, but the right kind for that position
On a right character the border stays plain and tells you nothing — the kind came with the character. Everywhere else, a plain border means the kind is wrong too. The game never tells you which kind is right: with only four, that would hand you the whole shape after two guesses.
Case matters
i and I are different characters. A greyed-out L does not rule out l. This is not Wordle: you are guessing a password, not a word.
Word found
When your guess contains the exact dictionary word the password is built on, the game says so and tells you what the rest is made of. From there it is about the mangling, not the word.
Hints
Three of them, and none costs you a try. The only cost is a 💡 next to your score when you share.
The pool ships with the page
The password list is in your browser, obfuscated but not encrypted in any meaningful sense. Anyone who reads the source can work out tomorrow's puzzle — a secret held on the client is not a secret. That is the first lesson of this game, so we would rather say it than have you find out.