Your first flag is usually one command away: a file, a strings call, and picoCTF{...} scrolls past. PicoCTF is the free capture-the-flag platform from Carnegie Mellon University that is built around that moment, and it remains the best free CTF for beginners because it teaches the basics other platforms assume you already have.
It works for a high school student, a college student or a career changer alike: no cost, no prerequisites. If you have never submitted a flag before, the Capture the Flag 101 lab walks you through finding and submitting one in a few minutes, and our CTF for beginners guide covers CTFs in general. This guide is about PicoCTF specifically: where to log in now that it has moved, the picoCTF 2026 competition, which challenges to solve first, and what to do once you outgrow it.
TL;DR: PicoCTF is a free, beginner-friendly capture-the-flag platform run by Carnegie Mellon University's CyLab. Since May 2026 it lives inside the CyLab Security Academy (cylabacademy.org), where old picoCTF accounts still work. Start with the General Skills challenges, then move through cryptography, web, forensics and reversing. The annual competition runs every March; picoCTF 2026 ran March 9-19.
Where did picoCTF go? On May 8, 2026, picoCTF.org became the CyLab Security Academy, Carnegie Mellon's free cybersecurity learning platform, run by the same team. picoCTF accounts created before that date log in there with their progress, achievements and history intact, and the practice challenges and the annual competition carry on. If an old picoCTF link lands somewhere unexpected, start from the CyLab Security Academy.
PicoCTF at a glance
- Cost: free for everyone, no paid tier
- Practice library: 500+ challenges, available year-round
- Competition: once a year in March, open to anyone 13 or older
- Level: built for complete beginners, middle school through adult
🎯 What is PicoCTF?
PicoCTF is a free capture-the-flag competition and year-round practice platform created by security researchers at Carnegie Mellon University's CyLab. It teaches cybersecurity to complete beginners through more than 500 self-contained hacking puzzles, organized by category and difficulty so you build skills in a deliberate order.
The platform started in 2013 as a competition for high school students and now reaches over a million learners, from middle schoolers to adults. Most CTF platforms assume you already know how to use a terminal, decode Base64, or read a packet capture. PicoCTF does not. That single design choice is why it shows up on nearly every "how do I get into hacking" list. Since CyberStart shut down in 2024, it is also the closest replacement for students who played that game, and our guide to CyberStart alternatives compares it with the other options.
🆓 Completely Free
No premium tiers, no paywalls, no "free trial" limitations. Every challenge is available to everyone. Carnegie Mellon runs it as an educational program funded by sponsors and grants, not as a business.
🎓 Education-First Design
Created for high school and college students with no prior experience. Challenges include hints, learning resources, and gradual difficulty progression.
📅 Year-Round Practice
The picoGym practice library holds 500+ challenges available 24/7. Each spring's competition adds new ones, but you can practice anytime.
🏆 Real Competition
The annual PicoCTF competition draws students from around the world every March. Great for building your resume and experiencing competitive CTF culture.
What is a CTF?
A Capture The Flag (CTF) competition challenges you to solve security puzzles to find hidden "flags," which are typically strings like picoCTF{example_flag_here}. Each challenge teaches a specific concept: decrypting messages, exploiting web vulnerabilities, analyzing files, or reverse engineering programs.
CTFs are how many security professionals first learned to hack. They provide safe, legal environments to practice attack techniques that would be illegal to try on real systems. PicoCTF runs in the "jeopardy" format: a board of independent challenges, each worth points, that you can attempt in any order. There is no opponent to attack and no shared scoreboard you can sabotage, which is exactly what you want when you are still learning what a flag even looks like.
In practice, the flag is just a string you submit to score the points. For PicoCTF it follows the format picoCTF{...}, and the moment you paste your first one into the answer box and watch the challenge turn green is the moment the whole thing clicks. Some flags sit in plain sight inside a file; others only appear after you decode something, exploit a bug, or coax a program into printing a value it was never meant to reveal.
ls -la, find and grep to recover the secret they hid, the same command-line reflexes PicoCTF's General Skills category trains.
📅 PicoCTF 2026 Competition: Dates, Rules and Prizes
picoCTF 2026 ran from March 9, 2026 (12:00 pm EDT) to March 19, 2026 (3:00 pm EDT), with registration open from February 1 to March 16. It was the competition's 13th year, and like every edition it was free to enter.
- Who can play: anyone 13 or older, anywhere in the world (under 18 needs parental consent). Teams have 1 to 5 members.
- Who can win prizes: cash prizes and a possible trip to CMU's Pittsburgh campus are reserved for top teams whose members are all enrolled in a US middle or high school. Everyone else still gets the global scoreboard and the challenges.
- Format: jeopardy-style, with new challenges across general skills, cryptography, web, forensics, reverse engineering and binary exploitation.
- After the event: competition challenges move into the practice library, so you can replay past years at your own pace.
What about picoCTF 2027? As of September 2026, Carnegie Mellon has not announced dates for the next edition. Every recent competition has taken place in March with registration opening a few weeks before, so watch the CyLab Security Academy site from January.
📂 PicoCTF Challenge Categories
PicoCTF organizes challenges into categories that cover the core areas of cybersecurity. Each one trains a distinct skill set, and the value is not the flag itself but the technique you keep afterward. General Skills builds command-line fluency, the thing every other category quietly depends on. Cryptography teaches you to recognize an encoding or cipher on sight, so you stop guessing and start identifying. Web Exploitation rewires how you read a request: you start noticing the cookie, the hidden form field, the parameter the developer trusted. Forensics trains patience with messy data, and binary and reverse engineering force you to think at the level the machine actually runs. The CyLab Security Academy has since added AI and Blockchain categories, but these six are the core you'll encounter:
🖥️ General Skills
Start here. Linux command line basics, file handling, scripting, and tool usage. These fundamentals are prerequisites for everything else.
Skills: Terminal, grep, pipes, Python basics
🔐 Cryptography
Cipher breaking, encoding/decoding, modern cryptography concepts. Learn to recognize and crack Caesar ciphers, RSA, XOR, and more.
Skills: Base64, hex, cipher identification
🌐 Web Exploitation
Attacking web applications. SQL injection, XSS, cookie manipulation, directory traversal, and authentication bypasses.
Skills: HTTP, cookies, basic web attacks
🔍 Forensics
Analyzing files, images, network captures, and memory dumps to find hidden data. Learn steganography, file carving, and evidence analysis.
Skills: File analysis, Wireshark, metadata
⚙️ Binary Exploitation
Low-level attacks on compiled programs. Buffer overflows, format strings, and memory corruption. More advanced, requires C knowledge.
Skills: C, assembly basics, GDB
🔧 Reverse Engineering
Taking apart compiled programs to understand how they work. Analyze executables to find flags hidden in the logic.
Skills: Disassembly, Ghidra, logic analysis
🎯 Recommended progression: General Skills → Cryptography → Web Exploitation → Forensics → Reverse Engineering → Binary Exploitation. This order builds knowledge progressively, with each category preparing you for the next.
🚀 How to Get Started with PicoCTF
Getting started is straightforward. Here's a step-by-step guide:
- Create a Free Account Go to the CyLab Security Academy, picoCTF's new home, and sign up. Already have a picoCTF account from before May 8, 2026? Log in with it instead. Use a real email; you'll need it for password recovery.
- Open the Practice Challenges The practice library, long known as the picoGym, holds every year-round challenge. Open the challenges section from the main navigation.
- Start with General Skills Filter by category and select "General Skills." Start with the lowest-point challenges: points track difficulty.
- Read Carefully, Use Hints Challenge descriptions often contain clues. Don't be afraid to use the hint system; learning is the goal, not suffering.
- Progress to Harder Categories Once you've completed 10-15 General Skills challenges, branch into Cryptography or Web Exploitation based on your interests.
Your First Challenge: What It Actually Looks Like
A typical first General Skills challenge hands you a file and a one-line description like "the flag is in here somewhere." You download it, and your instinct is to open it in a text editor. That works sometimes. More often the answer comes from three commands run in order.
Run file mystery first to learn what you are actually holding: a text file, a gzip archive, a PNG, an ELF binary. Then run strings mystery to dump every printable sequence, and pipe it into grep to find the flag without scrolling: strings mystery | grep picoCTF. If that prints the flag, you are done. If it does not, the data is hidden behind one layer of encoding, and you reach for CyberChef to peel it off. That find-then-decode loop, file into strings into grep, solves a surprising share of the early board and trains the muscle memory you will use on every platform afterward.
Essential Tools to Install
Many challenges require tools beyond a web browser. Set up these basics (our CTF tools guide covers the full kit):
- Linux environment: WSL on Windows, native Linux, or a VM. Local tools beat any browser shell once you get going.
- Python: Many challenges require scripting. Python 3 with common libraries (pwntools, requests) is essential.
- CyberChef: The "Swiss Army knife" for encoding/decoding. Bookmark gchq.github.io/CyberChef.
- Ghidra: Free reverse engineering tool by the NSA. Needed for RE and some binary challenges.
- Wireshark: Network packet analyzer for forensics challenges involving network captures.
💡 Pro tip: PicoCTF has long offered a browser "webshell" with common tools pre-installed. Use it when starting out, then move to your own environment as you get comfortable.
⚔️ PicoCTF vs Other CTF Platforms
PicoCTF isn't the only option for learning security. Here's how it compares to other popular platforms:
| Platform | Cost | Difficulty | Best For |
|---|---|---|---|
| PicoCTF | Free | Beginner | Students, first CTF experience |
| HackerDNA | Free tier; Pro from $10.19/mo billed yearly | All levels | Realistic browser-based hacking labs, no VPN |
| Hack The Box | Free tier; VIP+ $25/mo | Intermediate | Job seekers, realistic pentesting |
| TryHackMe | Free tier; Premium $16.99/mo | Beginner | Guided learning paths |
Prefer shell-based wargames to a challenge board? Our OverTheWire Bandit guide is the natural companion to PicoCTF's General Skills track.
When to Use Each Platform
Start with PicoCTF
Perfect for absolute beginners. Learn fundamentals through puzzle-style challenges. No cost, no pressure. Build confidence before moving to harder platforms.
Level Up with HackerDNA
When you're ready for real hacking. Move from puzzles to actual vulnerable machines. Practice the techniques you'll use in penetration testing jobs.
💡 Common progression: PicoCTF (learn basics) → HackerDNA Labs (realistic practice) → Certifications (OSCP, CEH) → Professional pentesting. Each step builds on the last.
💡 Tips to Solve PicoCTF Challenges
Stuck on challenges? These strategies will help you solve more flags and learn faster:
- Read the description carefully. Challenge descriptions often contain hints. The title, text, and attached files all provide clues. Don't skim.
- Google error messages. If a tool gives an error or you don't understand something, search for it. Someone has likely solved the same problem before.
- Use CyberChef liberally. When you see strange text, throw it into CyberChef and try common operations: Base64, hex decode, ROT13, URL decode. Chain operations until something readable appears.
- Master basic Linux commands. Many challenges require grep, cat, strings, file, xxd, and other command-line tools. Learn them well; they appear constantly.
- Don't skip General Skills. Even if they seem boring, these challenges teach fundamentals you'll need everywhere else. Complete all of them before moving on.
- Use hints without guilt. The goal is learning, not proving you can solve everything unaided. Hints are there to help you learn; use them and understand why the solution works.
- Take notes. Document how you solved each challenge. You'll reference these notes later when similar problems appear in harder challenges or other platforms.
🧠 The learning mindset: It's okay to struggle. It's okay to look up writeups after trying for a while. The goal isn't to solve everything independently. It's to learn techniques you can apply next time. Every challenge you solve, with or without help, teaches you something new.
📈 After PicoCTF: What's Next?
Completed the easier PicoCTF challenges and ready for more? One natural move is a live event, and our guide to entering your first CTF competition covers CTFtime, the formats, and how teams work. Here's how to continue your journey:
Signs You're Ready to Level Up
- You can solve most 100-200 point challenges without hints
- You understand basic cryptography, web attacks, and forensics
- You're comfortable with Linux command line and basic Python
- You want to practice on more realistic environments
The Next Step: Real Hacking Labs
PicoCTF challenges are puzzles: self-contained problems with clear solutions. Real penetration testing is different. You need to enumerate systems, chain vulnerabilities, and think like an attacker against realistic infrastructure.
🎯 HackerDNA Labs
Realistic hacking labs with actual vulnerable machines, right in your browser. Practice the full attack chain: reconnaissance, exploitation, privilege escalation, and post-exploitation.
Best for: Transitioning from CTF puzzles to real pentesting skills
🏆 HackerDNA Challenges
CTF-style challenges that bridge the gap between beginner puzzles and advanced exploitation. More realistic than PicoCTF, but still guided.
Best for: Continuing CTF practice at a higher level
Skills to Develop Next
- Network enumeration: Learn nmap, directory brute-forcing, service identification
- Web exploitation depth: SQLi, XSS, SSRF, file upload attacks against real applications
- Privilege escalation: Linux and Windows post-exploitation techniques
- Active Directory: Essential for real-world pentesting and certifications like OSCP
Build these skills with the recon and OSINT chapter of Hacking 101 and hands-on lab practice. The techniques you learned in PicoCTF are building blocks; now it's time to apply them against realistic targets.
❓ Frequently Asked Questions
Is PicoCTF really free?
Yes, 100% free. No premium tiers, no paywalls, no trial periods. Carnegie Mellon runs it as an educational program funded by sponsors, foundations and grants, and every challenge, hint and competition entry is free for everyone.
Where do I log in to picoCTF now?
At the CyLab Security Academy (cylabacademy.org). picoCTF.org became the Academy on May 8, 2026, and accounts created before that date log in there with their progress intact. New players simply sign up on the Academy.
What age is PicoCTF designed for?
PicoCTF targets middle school through college students, but anyone can practice, and many adults and career changers start there. To compete in the annual event you must be at least 13; prize eligibility is limited to students enrolled in a US middle or high school.
Do I need programming experience?
Not to start. General Skills challenges teach the basics, and you pick up Python along the way. Binary exploitation and reverse engineering need more programming knowledge, but you build up to those gradually.
Can PicoCTF help me get a job?
PicoCTF builds foundational knowledge but isn't enough on its own for job applications. Use it as a starting point, then move to realistic labs and certifications (Security+, CEH, OSCP) that employers recognize.
When is the annual PicoCTF competition?
Every March in recent years: picoCTF 2026 ran March 9-19, 2026. Dates for 2027 had not been announced as of September 2026. The practice challenges stay open year-round, and past competition challenges are added to the practice library after each event.
⚖️ Legal and Ethical Considerations
PicoCTF challenges are built to be attacked, so everything you do on the platform is authorized. The same techniques are not legal on systems you do not own. Keep your practice on CTF platforms and labs designed for it, and never run a scan, exploit or brute force against a real website "just to see".
Critical reminder: Always get explicit written authorization before testing any system. During the competition, also follow the event rules: no attacking the scoreboard or infrastructure, and no sharing flags with other teams.
Last verified: September 2026 (picoCTF competition details from picoctf.org, platform move from cylabacademy.org, competitor prices from their pricing pages).
🎯 Start Your CTF Journey
PicoCTF is still the cleanest free starting point in cybersecurity: 500+ puzzles that teach Linux, cryptography, web attacks and forensics one flag at a time, now under the CyLab Security Academy name.
- Create your free account on the CyLab Security Academy (or log in with your old picoCTF account)
- Clear the General Skills challenges first
- Branch into Cryptography and Web Exploitation
- Move to real machines with HackerDNA's hacking labs when puzzles start to feel easy
🚀 Mastered PicoCTF basics? Try the HackerDNA challenges: browser-based, no VPN, and a step closer to real penetration testing. Start with HackerDNA's free tier, no credit card required.
