United States · Ages 13 to 18 · Free practice, built to be hacked

picoCTF for beginners

picoCTF began as a capture the flag contest for high school students and is now a year-round learning platform called CyLab Security Academy, run by Carnegie Mellon University. A beginner solves small security puzzles, each hiding a string called a flag, in a space designed to be attacked so that the practice is legal. This guide covers what changed in 2026, who may sign up, the eight topic areas, how to begin without copying anyone’s answers, and two small Python examples we wrote to teach the first skills.

Book the free first class Book a priority demo See the eight-week plan Ask on WhatsApp

Live teaching since 2020 · 10,000+ students · ethical security, taught as skills

In short

A beginner should start picoCTF by creating a free account on CyLab Security Academy, the new name for picoCTF, reading the CTF Primer, and working through the beginner learning path in the Challenge Library before entering a timed event. Users must be at least 13, and teens under 18 need a parent’s email to register. Solve each challenge yourself: hints are built in, and sharing flags is grounds for removal. Modern Age Coders teaches this live online for US students, in a batch or one to one, and the first class is free.

Learn the skills with a teacher

Three courses for a picoCTF beginner

Capture the flag rewards understanding. These courses teach the ideas under the puzzles, from the terminal to encodings and web basics, always on the defending side.

Cybersecurity Competitions for Teens course thumbnail

PB / 01

picoCTF and CyberPatriot prep

Ages 13 to 18. Contest skills, learned ethically.

Open the syllabus →
Cybersecurity for Teens course thumbnail

PB / 02

Cybersecurity for teens

Ages 13 to 18. White-hat defense from the ground up.

Open the syllabus →
Python for Teens course thumbnail

PB / 03

Python for teens

Ages 13 to 18. The language most CTF scripts use.

Open the syllabus →

What changed

picoCTF is now CyLab Security Academy

Searches still say picoCTF, and so do many teachers. Here is what the new name means for someone starting now.

picoCTF in 2026, from picoctf.org and cylabacademy.org (read 17 October 2026)
QuestionWhat the official pages say
What is picoctf.org now?A notice titled "picoCTF.org is now CyLab Security Academy"
Who runs it?Carnegie Mellon University’s CyLab Security and Privacy Institute; the same team, described as a bigger mission
Old accountsLogins "created before May 8, 2026" still work, with progress and history intact
The picoCTF nameA button reads "Coming Soon: picoCTF.com"
Size"490+ hands-on challenges" on the learners page; 16 competitions hosted to date
CostFree; the site describes itself as always free for everyone

What stays the same

The core idea has not changed. Each challenge hides a flag that you find by reading, thinking and sometimes breaking things, and you submit it to score. The About page sums up the history: the largest high school hacking competition now provides year-round learning.

Practice problems from past competitions sit in the Challenge Library, which many guides still call the picoCTF gym.

How the platform is laid out now

The platform now lists four parts: Challenges, Learning Paths, Events and Classrooms. Learning paths add readings, videos and small games in order, which helps a beginner more than a long unsorted list.

Its list of domains now includes one for AI, covering prompt injection and adversarial examples, and one for blockchain smart contracts.

Sources: picoctf.org, cylabacademy.org, its learners and competitors pages, read 17 October 2026. Modern Age Coders is not part of Carnegie Mellon or CyLab and does not run picoCTF.

Who can sign up

The age rule: 13 and over, with a parent for under-18s

Before any practice, check the account rules. They come from the platform’s Terms of Use, effective January 30, 2025.

Account rules in the CyLab Security Academy Terms of Use
AgeWhat the terms say
Under 13May not register. To comply with the Children’s Online Privacy Protection Act, the Services are available only to users who are at least 13 years old
13 to 17A parent or legal guardian gives their email address at registration to show consent, unless a teacher registers the class in a batch
18 and overWelcome; the learners FAQ says college students and non-students can play
UsernamesNo real name or other personally identifying information in the username

For a family in the US

A 12-year-old who is keen on security should wait, and can spend the time on Python and on how the internet works. The platform is aimed at middle and high school students aged 13 or older.

For a 13 to 17-year-old, the parent’s email is part of sign-up. That is a good moment to agree how the account will be used and that it stays on the practice platform.

Prizes are separate from play

Anyone can compete to learn. Prize eligibility is set per event, and the learners FAQ notes that some competitions limit it to students enrolled in US middle or high schools.

If a teen wants to enter for prizes, read that event’s own rules when it is posted, because each event sets them separately.

Eight domains

The eight picoCTF challenge areas, in a beginner order

The platform lists eight domains. The descriptions are from its home page; the order is our suggestion for someone starting from zero.

CyLab Security Academy domains (official) and our suggested order for beginners
Our orderDomainWhat it covers (official summary)
1General SkillsThe terminal, bash scripting and quick file work, used in every other area
2CryptographyCodes, ciphers and locked data; how encryption and hashing work
3ForensicsHunting through files, images and network traffic for hidden data
4Web ExploitationWhy websites trust input too much: SQL injection, XSS, broken logins
5Reverse EngineeringWorking out what a program does without its source code
6Binary ExploitationHow careless memory handling lets software misbehave
7AIHow models can be tricked, from prompt injection to adversarial examples
8BlockchainBugs in smart contract code

Why General Skills comes first

Almost every later challenge assumes you can move around a Linux terminal, read files and run small scripts. Students who skip it get stuck on the tools rather than the puzzle.

The platform’s own Beginner’s Guide to the Challenge Library is described as its most approachable problems, touching every category but focused on General Skills. It is the natural first path.

Why binary comes late

Binary exploitation needs C, memory layout and assembly. These are rewarding, but they make more sense after a student has written a few programs and seen how data is stored.

Our order is a teaching choice, not a rule. A student who loves websites can move Web Exploitation earlier once the terminal feels comfortable.

First steps

How to start picoCTF as a complete beginner

Six steps, in order, using only the platform’s own free material. The learners FAQ says the minimum you need is the ability to think critically.

  1. Create an account. Sign up on CyLab Security Academy and confirm the email. Under-18s register with a parent’s email; old picoCTF logins still work.
  2. Read the CTF Primer. It is a free textbook-style guide with chapters on the shell, forensics, Python, web exploits, cryptography, networks and assembly, written by the education team.
  3. Take the beginner path. Open the Beginner’s Guide to the Challenge Library and solve its problems in order, reading each linked explanation.
  4. Use the webshell. Many challenges need only a web browser and the provided webshell, so a school Chromebook can be enough to begin.
  5. Use hints, one at a time. The home page says hints are available one at a time when you are stuck. Take one, think again, and only then take the next.
  6. Enter an event. When a timed event appears in the Events tab, join it. The competitors page says there is no penalty for wrong guesses, so trying costs nothing.

A copied flag scores a point and teaches nothing about finding the next one. Our classes never hand over flags or walkthroughs for platform challenges: the teacher explains the concept behind a stuck point, and the student solves the challenge.

Playing fair

The ethics of capture the flag, in plain terms

Security skills can protect people or hurt them. The platform draws the line clearly, and so do we.

Rules of the road for a picoCTF beginner (official lines, with our notes)
RuleWhy it matters
Practise only where it is allowedThe home page says "Every challenge is built to be hacked, so the practice is legal". School networks, websites and friends’ accounts are not.
No spoilers during eventsThe Discord is not for competition challenge help, and "spoilers or flag sharing during a competition are grounds for removal".
Your own work countsA flag copied from a forum scores points and teaches nothing.
Defend with what you learnThe platform says it teaches you to think like a hacker, then use that thinking to defend systems.

Why the shortcut costs more now

CyLab’s own white paper, Skill or Shortcut?, reports that six years of competition data show the post-AI cohort improving at nearly half the rate of the pre-AI cohort.

Our reading: getting the answer and building the skill have come apart. An AI chatbot can often explain a challenge, but a student who never struggles with it does not get faster at the next one.

How we use AI in class

Students may ask an age-appropriate AI tool what a command or error means, then try it themselves. They do not paste a challenge in and ask for the flag.

Check a tool’s own age terms first. Many general chatbots set minimum ages, and some are for adults only.

Python examples

Two Python skills every picoCTF beginner uses

Both examples run on our own sample strings, not on any challenge. They teach two habits that appear across the General Skills and Cryptography areas.

Python · undo layers of encodingpython
# layers.py (ours): undo two layers of encoding, one at a time
import base64

message = "624746355a584a7a"   # our own sample, not a challenge

step1 = bytes.fromhex(message).decode()
print(step1)                   # bGF5ZXJz  (still encoded)

step2 = base64.b64decode(step1).decode()
print(step2)                   # layers

Hex and base64 are encodings, not encryption: anyone can reverse them without a key. Recognising them on sight is a first skill. Hex uses only 0 to 9 and a to f; base64 mixes upper and lower case letters, digits, plus and slash, and often ends in an equals sign.

Python · find flag-shaped textpython
# find_flags.py (ours): pull flag-shaped strings out of text
import re

log = """09:14 user=ana opened notes
09:15 picoCTF{pr4ct1c3_0nly}
09:16 picoCTF{this_line_is_much_too_long}
09:17 user=ana closed notes"""

# the pattern the CTF Primer uses to describe a flag
pattern = r"picoCTF\{.{1,15}\}"
print(re.findall(pattern, log))   # ['picoCTF{pr4ct1c3_0nly}']

The CTF Primer describes flags as often in the format picoCTF{} and gives the regular expression picoCTF\{.{1,15}\} for one. Our second sample line does not match because its middle is longer than 15 characters, which is a lesson in reading a pattern exactly.

What the examples teach

Work one step at a time and print after each step. When a result still looks like gibberish, the printed middle step tells you what to try next.

Regular expressions turn a long output into the one line you need. The same skill helps a defender search a log for one suspicious entry.

What they deliberately skip

Neither example solves a real challenge, and we will not publish one that does. The point is to recognise a technique, so that when a student meets it on the platform, the thinking is theirs.

Both use only Python’s standard library, so they run in the webshell or any editor without installing anything.

At school

If picoCTF will not load on a school network

Many US schools filter new domains by default. The learners FAQ lists the domains a network administrator can allow.

Domains CyLab Security Academy asks schools to allow (learners FAQ, read 17 October 2026)
DomainAccess
cylabacademy.orgHTTPS
learn.cylabacademy.orgHTTPS
webshell.cylabacademy.orgHTTPS
challenge-files.cylabacademy.netHTTPS
xebec.cylabacademy.netAll ports, UDP and TCP
chatelaine.cylabacademy.netAll ports, UDP and TCP

Classrooms on the platform

Teachers can create a classroom with an invite code, post assignments that bundle challenges and learning paths with due dates, and see each student’s progress. A student can belong to several classrooms, for a class and a club.

Under the terms, a teacher batch registration is also how students aged 13 to 17 can join without each giving a parent email.

Teams in events

For team-enabled events, the My Team page creates or joins a team with an invite code. The learners page says teams may have 1 to 5 players from different schools.

To be eligible for prizes, every player on the team must meet that event’s rules.

Eight weeks

An eight-week start for a picoCTF beginner

Our plan for a 13 to 15-year-old with no security background, about three hours a week including one class. It uses the free platform material throughout.

Eight weeks from sign-up to a first timed event (ours)
WeekFocusFinished when
1Account, Primer chapter on the shellCan list, read and search files in the webshell
2Beginner path, first General Skills problemsFive beginner problems solved without walkthroughs
3Python basics for CTFCan read a file and print what is inside it in a script
4Encodings: binary, hex, base64Recognises each on sight and reverses it in Python
5Classical ciphersCan explain why a Caesar cipher is easy to break
6Forensics basicsCan inspect a file’s type and metadata
7How the web worksCan read a page’s source and explain a cookie
8A first eventEntered a timed event and wrote down what to learn next

Ages 13 and 14

Short sessions, lots of talking through ideas. The goal is curiosity and the terminal, not points.

Ages 15 and 16

Add Python scripting early, and keep a notebook of every technique learned.

Ages 17 and 18

Move into web and reverse engineering sooner, and consider CyberPatriot as a team defense contest alongside.

Readiness

Four stages from first flag to confident player

Where beginners usually are, and what the next step looks like.

picoCTF progress stages (ours)
StageThe student can
1. ExplorerMove around the terminal and read files
2. DecoderRecognise common encodings and simple ciphers
3. InvestigatorChoose a tool for a forensics or web problem and explain why
4. CompetitorEnter a timed event, manage time and learn from misses

For parents

The platform is free and built to be attacked, so it is a safe place to learn what attackers do. Talk with your teen about where that line is.

Progress is slow at first because the tools are new. Weeks of General Skills are normal and valuable.

For students

Write down every technique you learn with one example. Your notebook becomes your own primer.

When stuck, take one hint, then explain the problem out loud. Most breakthroughs happen at that point.

The catalogue

Nine courses for teens who want to learn security

All taught live online, ages 13 to 18, grouped by the picoCTF areas they support.

I

Foundations

General Skills
II

Web and data

Web and forensics
III

Low level

Reverse and binary

Lesson times

Security lessons that fit a school week

Weekdays or weekends, flexible: choose your batch, or for a very personalised plan choose 1-on-1 at your convenience, weekend mornings or weekdays.

Weekdays

An after-school class in your time zone.

Weekends

Longer practice before a timed event.

1-on-1

For a teen who wants to go deep fast.

Defense first

Every technique, and how to stop it.

No flag sharing

Concepts taught; challenges solved by the student.

Terminal fluency

Linux commands until they are habit.

Python scripts

Small tools the student writes.

Ages 13 to 18

Matched to the platform’s own age rule.

Batch or solo

Fifteen to twenty learners, or one to one.

Student work

Projects our students made

Security grows from building things. These are our learners’ own projects; see the student labs for more.

NutriLife AI nutrition coach project screenshot

AI and ML

NutriLife

An AI nutrition coach that reads what you eat and works you toward a target.

by Bhavya · Open it

Misti AI chatbot for maths and coding screenshot

AI and ML

Misti

A chatbot that answers mathematics and programming questions, built and deployed by a student.

by Harshit · Open it

GuardianX AI internet safety assistant screenshot

AI and ML

GuardianX

An assistant that helps a young person recognise unsafe situations online.

by Vivaan · Open it

SkyCast weather forecast application screenshot

Web app

SkyCast

A weather forecasting site with live conditions for any location.

by Krish

Fees

Fees

The platform itself is free. Our part is the teaching, charged monthly in US dollars with no long contract, so a teen can learn the foundations over a semester and continue only if it clicks.

Free first class

USD 0

no card required

  • A free first lesson
  • A look at your account
  • No card details
Book it

Group batch

USD 100

a month, billed in US dollars

  • Fifteen to twenty learners
  • A regular security teacher
  • Choose a batch time
  • Monthly billing
Start here

One to one

USD 150

a month, billed in US dollars

  • One teen, one teacher
  • Paced to their interests
  • Deep dives on request
Enquire

What families say

Rated 4.9 across 547 Google reviews

Parents’ Google reviews, as written.

★★★★★

"The one step solution for my son. Modern Age Coders make learning coding so simple that kids love it. The teachers explain complex concepts clearly with practical exercises and interactive content."

Ria Mukherjee

Parent

★★★★★

"Modern Age Coders has been a game-changer for me. I struggled to grasp IT concepts and coding before joining, but their classes transformed everything. I can now confidently write complex programs with ease."

Samriddha Mondal

Student

★★★★★

"One of the most wonderful education centres out there. Education is not limited to school syllabus but focuses on skill development."

Vansh Agarwal

Student

★★★★★

"My child Dhairya is really enjoying the Modern Age Coders classes. This is his first online class and he eagerly looks forward to it. I can already see his improvement, and the teachers are very cooperative."

Sonam Oswal

Parent of Dhairya

★★★★★

"Modern Age Coders have wonderful teachers who teach in a clear, easy and practical way. The teacher boosts students' confidence and inspires them to learn without hesitation."

Sonu Goyal

Parent

★★★★★

"I highly recommend this computer coding class! The teachers are incredibly knowledgeable and passionate about coding."

Ritu Kedia

Parent

Questions from families

picoCTF for beginners: common questions

Is picoCTF still running?

Yes, under a new name. The picoctf.org site says picoCTF is now CyLab Security Academy, Carnegie Mellon University's free cybersecurity learning platform, and old picoCTF logins still work.

How old do you have to be for picoCTF?

At least 13, under the platform's Terms of Use. Teens aged 13 to 17 need a parent or guardian's email at registration, unless a teacher registers the class.

Is picoCTF free?

Yes. CyLab Security Academy describes itself as always free, supported by sponsors and gifts.

What is the picoCTF gym?

The name many guides use for the practice area. On the new platform it is the Challenge Library, with problems from past competitions and new ones, open year-round.

Where should a complete beginner start?

With the CTF Primer and the Beginner's Guide to the Challenge Library learning path, which focuses on General Skills such as the terminal and simple scripts.

Do I need to know programming first?

No. The learners FAQ says the minimum is thinking critically, and many players began with no programming. Python, HTML, JavaScript and C help, and are worth learning along the way.

What does a picoCTF flag look like?

The CTF Primer says flags are often in the format picoCTF{} with text inside the braces. You submit the full string to score.

Is it legal to hack picoCTF challenges?

Yes, on the platform. Its home page says every challenge is built to be hacked, so the practice is legal. Using the same techniques on systems you do not own or have permission to test is not.

Will you give my teen the answers to picoCTF challenges?

No. We teach the concept behind a stuck point and the student solves the challenge. During events, sharing flags or spoilers is grounds for removal from the community.

When are classes held?

Weekdays or weekends, flexible: choose your batch, or for a very personalised plan choose 1-on-1 at your convenience, weekend mornings or weekdays.

When is the next picoCTF competition?

On 17 October 2026 the competitors page said details were coming soon. The platform runs mini-competitions through the year and an annual flagship for US middle and high school students, listed in the Events tab.

Elsewhere on this site

Related pages

More for US teens interested in contests and computer science.

Coding classes in the USA

All of our US pages in one place.

CS extracurriculars

Where capture the flag fits.

Hackathons for high schoolers

Build on a deadline, in teams.

USACO coaching

The programming olympiad.

Coding for 15-year-olds

What to learn at fifteen.

Student labs

Projects our learners built.

CyberPatriot preparation

CyberPatriot 19 (2026-27) explained from the official pages, with a practice plan.

Technovation Girls guide

Technovation Girls and the 2026-27 Technovation Challenge, from the official pages.

Coding competitions for high school students

US high school coding competitions for 2026-27, from the organisers' own rules.

Start here

Book a free first lesson

Bring your account, even if no challenge is solved yet. The teacher checks the terminal basics first and sets a starting point on the beginner path.

If you would like the details first, how we teach explains our lesson format, and the course list shows each syllabus.

WhatsApp us · +91 91233 66161 · connect@modernagecoders.com

We teach online from India, at hours that suit US time zones. WhatsApp reaches the team fastest.

Free first lesson, no card asked for.

Want a class sooner? Book a priority demo

A priority demo is a full class of about 45 to 60 minutes. After the class the mentor sends a written skill report and a personal learning roadmap on WhatsApp. If you enrol, the demo fee is adjusted against your first month's fee. Share your demo Order ID with us on WhatsApp and we take it off.

Book a priority demo

Keep exploring Modern Age Coders

Related courses and guides

Learn more

Free resources

From the blog

Start here

Free classPriority demoCall us