Help and support

No. The sample cards on the home page are graded for real without one. An account is what stores your progress, unlocks the explanation behind each verdict and puts you on the ladder.

With an email address and password, or with Google, GitHub or Facebook. The iOS app also offers Sign in with Apple. Whichever you use, it is one Hexret account: your progress is the same on the web and in the apps.

Check your spam folder first, then request a new link from the sign-in page. If it still does not arrive, write to [email protected] from that address and we will look at what happened to it.

Use Reset password on the sign-in page and we email you a link to set a new one. If you signed up with Google, GitHub, Facebook or Apple there is no Hexret password: keep signing in with that provider.

A curated starter set of modules (all of Security Fundamentals, half of Web and AI Security, three Cloud modules), two campaigns, five workflows, the five newest CVEs, and three quick runs, three duels and three time attacks a day. It never expires.

The surface shows a countdown to the next day boundary and everything else stays open. Duels you have already started are never cut short.

From the upgrade page in the app, monthly or yearly. The price, including VAT, is shown before you pay. Payment goes through Stripe, which handles your card; we never see it. Pro is bought on our website and applies to your account everywhere, including the apps.

Inside the first 14 days the whole first payment comes back and Pro ends there and then; that withdrawal is available once per account. After that, cancelling stops the renewal; Pro stays open until the end of the period you paid for, and nothing you earned is lost.

Yes, from the upgrade page while your monthly plan is active.

Concept Flash, Code Spot, Vulnerability Hunt, Diff Challenge, Config Audit, Attack Chain, Bypass Puzzle and Traffic Monitor. Each puts real material on screen, such as code, a config, a packet capture or a kill chain, and asks for a judgement about it. Nothing is a definition quiz.

Four tiers, Novice to Expert: recognition, application, analysis, then mastery calls on realistic material with nothing signposted. Higher tiers are worth more XP once mastered.

XP lands the moment a card is graded, once per card, with more for harder tiers. Levels go up to 120. Your streak counts the consecutive days on which you played at least one card; a card today keeps it safe until tomorrow.

Yes. Every duel is ranked on every plan and moves your rating the same way. Free is metered at three a day; the only part of a duel payout it does not receive is the token.

A season is one calendar month. Every ranked duel moves your rating, and anyone who resolves at least one ranked duel in the month is eligible for its podium. When the month ends, the top three places win a month of Pro, added to the account automatically.

Tokens are earned by playing on Pro and are spent in Rewards on cosmetics and boosts: a leaderboard name colour, a code theme, a profile hex ring, a 2× XP hour, a mastery certificate and more. They have no cash value and cannot be bought, sold or transferred.

Any time, from the account menu. The roadmap and the theme switch immediately. Mastery, level, streak and rating belong to your account and are not partitioned by path.

Every card is written by people, validated on import and served from a content store. Nothing is generated when you press play, so the same card is always the same card, and a CVE entry is anchored to the real disclosure, CVSS vector and CWE.

Use the review option on the card or on the run summary, or the Send feedback button. Say what you expected and why. Reviews carry the card id, so we can find it straight away.

Display name, bio and avatar: in Settings. To change the email address on your account, write to [email protected] from the current address.

In Settings, press Delete account and type your handle to confirm. The account and its data are deleted straight away. If you cannot sign in, email [email protected]. Full details: deleting your account and data.

No. There are no ads, no analytics and no third-party tracking cookies; Hexret stores only what it needs to work. The Privacy Policy lists everything we collect and why.

Tell us at [email protected], or through the feedback form, instead of exploiting it. We do not take action against good-faith reports that stay within that.

Yes, for iOS and Android. It is the same account and the same cards; your progress, streak and rating are shared with the web. An offline bar tells you when an answer cannot reach us, and nothing pretends it did.

A ping when a new season opens or when you finish on its podium, nothing else. You can turn them off in your device settings.