Password Fortress: free game to learn strong passwords

What is Password Fortress?

Hackers attack in ten waves: brute force, leaked passwords, fake login pages, SIM swaps. Pick the strongest password or the setting that holds the gate, and learn why it works.

Password Fortress is a free cybersecurity game. Hackers attack your fortress in ten waves, and each wave names a real attack: password guessing, brute force, credential stuffing with leaked passwords, fake login pages, a caller asking for your code, a SIM swap. Pick the strongest password or the setting that stops it before the clock runs out.

Password waves reveal how long each option would hold against a fast offline attack, from "instantly" to "millions of years". Defence waves explain why two-step verification, unique passwords, passkeys, updates and encryption work.

At a glance

Category

Adventure

Difficulty

Easy

Play time

2–3 min

Price

Free, in your browser, sign-up optional

How to play

Read the attack

Each wave names the attack: guessing, brute force, credential stuffing, phishing, social engineering…

Hold the gate

Pick the strongest password, or the setting that stops that attack.

Beat the clock

16 seconds for the first wave, a little less each time. A wrong pick or a timeout costs a life.

Learn

Every wave explains the defence; password waves show how long each option would last.

Scoring

Each right answer scores 100 points, plus up to 50 for answering fast and up to 50 for a streak (10 for every right answer in a row, up to five).

A wrong answer or a timeout costs one of your 3 lives. Your best score is kept in this browser.

What it trains

Strong passwords

Length, passphrases and password managers.

Account security

Two-step verification, passkeys and updates.

Spotting attacks

Phishing pages, fake calls and SIM swaps.

Strategy and tips

Length wins

A long passphrase of random words beats a short password full of symbols.

One site, one password

Leaked passwords get tried everywhere. A password manager keeps them unique.

Turn on two-step

An authenticator app or passkey stops most account takeovers, even with a stolen password.

Never share a code

Banks never ask for a one-time code. The caller asking for it is the attacker.

A padlock isn't proof

Fake sites have padlocks too. Check the domain, or let a password manager do it.

Why play Password Fortress?

Most hacks don't need genius: they reuse leaked passwords, guess weak ones or trick people into sharing codes. A handful of habits blocks almost all of them, and a quick game makes them stick.

Frequently asked questions