Eighteen rules. A running clock. Good luck.
Flip a CoinHeads or tails? Flip with satisfying animations
Roll DiceRoll virtual dice with satisfying animations
Infinite CraftStart with four elements. See how far it goes
Draw a Perfect CircleOne freehand loop, scored to the percent
Reflex TapStop the bar at the center - one tap, pure reflex
2048Slide and merge tiles to reach the magic number
Cat TrapTrap the cat before it escapes the board
Draw Logos From MemoryTest how well you remember famous brand logos You are asked to make a password. Simple enough, until the rules start arriving. Include a number. Now include a special character. Now the digits must add up to 25. Now it must contain a month of the year. Every time you satisfy a rule, another one appears, and the earlier rules never go away.
The joke lands because everyone has met the real version of this. Password requirements that demand a capital, a symbol, and no symbol from a list they will not show you, are a genuinely universal irritation. The game just keeps going until the requirements become absurd, and the frustration curve is the entertainment.
Eighteen rules, revealed one at a time, and every earlier rule still applies. They escalate from ordinary requirements like a number and an uppercase letter into arithmetic constraints (the digits must total 25, the Roman numerals must multiply to 50), external knowledge (a chemical element symbol, a leap year, today's actual day of the week), and finally a rule about the password's own shape: the total length must be a prime number.
That last one is deliberately cruel, because every other fix you make changes the length and can knock it off a prime. It is solvable, and there is a timer running while you work it out.
Complex composition rules make passwords worse, not better. Forcing capitals, digits and symbols pushes people toward predictable patterns, capitalising the first letter, appending a 1 and an exclamation mark, and substituting a zero for an O. Attackers know all of these, so the resulting passwords are shorter and more guessable than a plain string of random words.
Modern guidance has moved on. The US National Institute of Standards and Technology now recommends length over composition rules, dropping mandatory periodic expiry, and checking passwords against lists of known breached ones instead. Longer is genuinely better than more complicated, which is precisely the opposite of what this game demands of you, and why it is funny.
If you enjoy being deliberately antagonised by an interface, I'm Not a Robot does the same thing to CAPTCHA verification, and Absurd Trolley Problems does it to moral philosophy. All of them are free, run in your browser and need no sign-up.
You build a password against eighteen rules that are revealed one at a time. Every earlier rule still applies, and a timer runs from your first keystroke, so it is a race as well as a puzzle.
Eighteen. They escalate from ordinary requirements like a number and an uppercase letter into arithmetic (the digits must total 25, the Roman numerals must multiply to 50), outside knowledge such as a chemical element symbol and today's day of the week, and finally a rule about the password's own length.
Yes. Every rule can be satisfied simultaneously, and the game records your completion time. It is deliberately fiddly rather than impossible.
Build long from the start, since later rules need room. Leave the digit sum and the prime length until last, and do them in that order, because changing the digits also changes the length.
Your best completion time is stored in your own browser. There is no account and nothing is sent to a server.
No, and that is the joke underneath the game. Forcing capitals, digits and symbols pushes people toward predictable patterns. The US National Institute of Standards and Technology now recommends length over composition rules and checking against known breached passwords instead.
Yes, though a physical keyboard makes the later rules considerably less painful, particularly the ones that need specific characters.