About the playground
Built to be attacked — in the right places only.
Uncrypt Playground is a self-contained training range. Each lab is an isolated, deliberately vulnerable mini-app. The platform around it — this site, your progress, the walkthroughs — is hardened and holds no real accounts or data, so there is nothing here worth stealing. Attack the labs; the playground itself stays out of scope.
Exploit, don't guess
Every lab hides a flag like UNCRYPT{…} that only appears once you actually pull
off the attack. Submit it on the lab page to mark it solved.
Finish the set, get certified
Complete every lab in a set and claim a signed, verifiable certificate of completion with your name on it — Burp Suite Master, OWASP Top 10 Master, Modern Web Security Expert, Uncrypt AI Security Master. Names are permanent once issued, and anyone can verify a certificate from the home page.
Nudges, not spoilers
Each lab nudges you toward the technique — and, for proxy tracks, which header or parameter to intercept — but never the payload. Full write-ups live in the Walkthroughs.
Nothing real is reachable
Dangerous primitives — SSRF fetches, command execution, file reads, LLM calls — run against bundled mocks, never the real host or network. Nothing you do here leaves the sandbox.
Your progress
Solves are stored only in your browser's local storage — they survive a refresh, and they reset if you clear site data or use a private window. Nothing is sent to the server.