picoCTF
A free capture-the-flag cybersecurity competition designed specifically for students with no security background.
Run by Carnegie Mellon University
Key facts
- Eligible grades
-
Anyone may compete. To be eligible for prizes you must be a middle or high school student enrolled in an accredited US school, or home-schooled at that level in compliance with your state's requirements.
Source, checked 2026-09-01
- Recommended preparation
-
Comfort with a command line and basic scripting
Why: Challenges span general skills, cryptography, web exploitation, forensics, binary exploitation and reverse engineering. Hints are built into the game and a free practice gym stays open year-round, so no formal course is needed.Based on the official syllabus and content covered.This is Compete's reading of the competition's documented content, not a requirement stated by the organiser. You may enter without it.
- Compete guidance, not an eligibility restriction. Students outside this are still eligible if the official eligibility above allows them.
- Eligible ages
-
For prize eligibility: at least 13 and younger than 20, and without a high school diploma or GED.
Participation itself has no upper age limit; CMU describes the platform as suitable from middle school through industry. Participants must be at least 13 to hold an account, and under-18s need parental or guardian consent.Source, checked 2026-09-01
- Individual or team
- Team · Compete alone or form a team with up to four other eligible participants, so five in total.
- Where it runs
- Online · International
- Entry cost
- FreeNo premium tiers, no paywalls. All challenges are available at no cost.
- Registration deadline
- Set locally, not published as a single national date No registration deadline in the usual sense. You create a free account at picoctf.org at any time; the constraint is the competition window itself.
- Competition dates
- A two-week competition window, historically in March. The picoGym practice archive is open all year.
- Difficulty
- Some preparation neededYou will want a few weeks of targeted practice. Most motivated students place respectably.
- Prizes
- For the 2026 competition, cash prizes in the US middle and high school category ran in tiers of $2,000, $1,500, $1,000, $750 and $500, with winners possibly invited to Carnegie Mellon's Pittsburgh campus for an award ceremony or attending virtually.Cash awards for the top-scoring eligible US middle and high school teams. Amounts vary by year and sponsor; confirm on the official site.
What picoCTF is
picoCTF is a free online cybersecurity competition run by Carnegie Mellon University. It is a capture-the-flag event: you are given deliberately vulnerable programs, files and web services, and you find hidden strings called flags by reverse engineering, exploiting or analysing them. It is built for beginners, the practice gym stays open all year, and it is one of the few genuinely accessible routes into security for a student.
How the competition works
A capture-the-flag competition running roughly two weeks each spring, covering general skills, cryptography, web exploitation, forensics, binary exploitation and reverse engineering. Hints are available within the game. The picoGym practice platform stays open year-round after each event.
Eligibility notes
US middle and high school students are eligible for prizes. Anyone in the world, including adults and university students, can compete in the open division and use the picoGym.
Is picoCTF right for you?
- Experience needed
- None. The introductory challenges teach from zero and hints are built in.
- Time commitment
- As much as you want. The practice archive is open year-round.
- What you actually do
- Solve security puzzles in a browser: recover a hidden flag from a file, break a weak cipher, exploit a deliberately vulnerable program.
A good fit if
- You are curious about security and have no idea where to start
- You want something free and open worldwide
- You like puzzles with a definite answer
Probably not for you if
- Students wanting a team-based or in-person event
Common mistakes
- Skipping the Linux command line, which unlocks a large share of the challenges.
- Refusing hints. They are part of the design and cost you very little.
- Only playing during the competition window when the practice gym is open all year.
How to register
- Create a free account on picoctf.org.
- Start with the picoGym archive immediately. It is open year round and contains every past challenge with hints.
- Form a team of up to five before the competition window opens, or compete alone.
- Compete during the two-week window. Challenges unlock progressively and points scale with difficulty.
What skills you need
- Linux command line
- Python scripting
- Cryptography basics
- Web security
- Reverse engineering
- Persistence and lateral thinking
Recommended resources
-
picoCTF and the picoGym
Registration plus a permanently open archive of every past challenge with hints and walkthrough support.
-
picoCTF learning guides
Official primers on each challenge category, written for students with no background.
-
OverTheWire Bandit
Free wargame that teaches the Linux command line through 30 levels. The best single preparation for picoCTF general skills.
Past problems and materials
Only materials the organiser or an authorised archive publishes openly are listed here.
- picoGym: every past challenge
The complete archive of past competition challenges, free and permanently available.
Helpful videos
- John Hammond
Capture-the-flag walkthroughs including picoCTF challenges, explained step by step.
Frequently asked questions
Do I need any security knowledge to start?
No. picoCTF is designed specifically for students with no background, and the first tier of challenges in each category assumes only that you can use a computer and follow instructions.
Can I practise outside the competition?
Yes. The picoGym contains every past challenge and is open all year with no registration window, which makes it the best free cybersecurity learning resource for students.
What do I need installed?
Most challenges run in the browser. For harder categories a Linux environment is useful, but picoCTF provides a browser-based shell so you do not need to install anything.
Reviews, tips and resources from other students
Posts are public. Do not share your full name, school, address or contact details.
Something out of date?
If a deadline, fee or eligibility rule on this page no longer matches the official site, flag it and it goes into the review queue.
You might also look at
- Grades6 to 12
- CostFree to $250
- Grades6 to 12
- CostFree
- Grades1 to 12
- Cost$125 to $175
- Grades6 to 12
- CostFree
- FormatEither
- WhereOnline