Yes, we answered that

Yes. TryHackThisBitch.com is an educational site. Every challenge runs inside our own sandboxed demo environment. Nothing here is pointed at real third-party systems, and nothing on this site will ever ask you to attack a system you don't own or aren't explicitly authorized to test. The only law we want you breaking is your own skill ceiling. See the Terms and the ethics section.

No. Challenges are rated easy / medium / hard and each one ships with hints and a lesson. If you can type, you can start on the easy lane. The difficulty curve is honest — but walkable.

It's a deterministic generator that builds challenges on your device from a survey you optionally fill in plus your solve history. It tunes difficulty, topic mix, and pacing. No cloud AI, no servers needed — it runs entirely in your browser. Same seed means the same challenges for you all day.

There are 31 hand-crafted daily challenges — one per calendar day of the month. The current one comes from daily-data.js; the engine picks on the daily page are generated fresh from your profile. Both are free.

Free includes the core challenge set, the dailies, the engine picks, gamification (streaks, badges, leaderboard), and the tool guides. Pro unlocks the deep-end lab challenges (XXE, RSA, timing attacks, ROP, crackmes) plus infinite engine-generated labs. Pro pricing ships with the Stripe integration.

The simplest: leave your progress local and use one browser — it's all in your browser's local storage. If you want it to follow you, create an account on the account page, then push the browser's grind to the cloud. On the other device, sign in and pull. Push and pull are explicit — nothing merges silently, you're the merge. Erase your account from the same page whenever you want.

No tracking, no analytics network calls, no fingerprinting, no third-party scripts. If you're not signed in, the only cookie is a consent cookie set after you use the banner. If you sign in, the API host also sets an HttpOnly session cookie — no scripts can read it. Everything else is local storage in your browser. Full details in the privacy policy and cookie policy.

Yes — that's the goal. The patterns are real (SQLi, XSS, IDOR, JWT flaws, format strings, Raid-style RSA crackme math). Use them only for defense, or on systems you own or are paid/authorized to test. The skills are transferable; the permission is not.

Every challenge has three hints — the third one gives the flag. Use them unapologetically; learning to ask the right question is a skill too. If it's still broken, open the help desk.

Everything on the free tier is a live, interactive demo: injection queries execute in-session, ciphertext actually decrypts, cookies actually get flipped. Verify it yourself — the demos are right there on the challenge pages. We don't fake the flag turns green.

Yes — the help desk has a suggestion box, and the survey feeds ideas into the engine. If you submit something we ship, you'll get a shoutout on the about page.

We do, loudly, in the terms of service. Read them — mostly because people don't, and you'll have an advantage.