For instructors
The hardest part of teaching security is rarely the material. It is getting thirty students through a toolchain install on thirty differently-broken laptops before anyone has decoded a single string. ctfpal removes that step entirely: 89 tools in one page, no install, no account, and nothing that leaves the browser.
10
sequenced modules
~16 h
of contact time
89
documented tools
Why it works in a classroom
Nothing to install
It is a web page. A student on a locked-down lab machine, a Chromebook, or a borrowed laptop has exactly the same environment as everyone else. There is no virtualenv to break and no package that fails to compile ten minutes into the session.
Nothing leaves the browser
Every algorithm runs client-side. Challenge files, hashes, and pasted text are never uploaded, so there is no third-party service processing student work and no data protection question to answer before the first class.
No accounts, no roster, no cost
There is no sign-up, no per-seat licence, and no free tier that expires mid-semester. Nothing to administer and nothing to renew.
It works offline
The page registers a service worker and caches itself. Once loaded, it keeps working without a network - which matters in an isolated lab, and matters more during a live competition when the venue wifi collapses.
Algorithms, not a black box
There is no generative AI in the solving path: results come from named, deterministic algorithms that produce the same answer every time, which is what makes them teachable and gradeable. Every tool page explains the method - chi-squared scoring, index of coincidence, Hamming-distance keysize detection, continued fractions - so students learn the technique rather than which button produces a flag.
For your IT or data protection review
ctfpal is a static web application. All processing - decoding, cryptanalysis, hashing, file parsing, steganography extraction - happens in the browser using JavaScript and WebAssembly. Files that students open are read locally through the File API and are never transmitted. The application has no user accounts, no authentication, no server-side storage, and no analytics or telemetry. Workspace state is stored in the browser’s own IndexedDB on the student’s machine and can be cleared like any other site data. The source is public and MIT licensed, so it can be reviewed, forked, or self-hosted on institutional infrastructure.
Three features make outbound network requests, and only when a student explicitly uses them. The HTTP request replayer and the path scanner send requests to a target the student names - both are for authorised targets only, and are covered by the responsible-use note below. The optional LLM triage helper sends the student’s input to whichever provider their own API key belongs to; it is off unless a key is entered, it is never wired into a solver, and the alternative in-browser model runs locally with no requests at all. If sending student work to a third-party model is not acceptable in your setting, simply do not issue a key - every other tool is unaffected.
Take it away with you
A list of modules is not a lesson. These are the documents between a syllabus and something you can walk into a room holding - all printable, all MIT licensed, none of them asking for an email address.
Course syllabus
The whole course as one printable document - hours, objectives, assessment, the data-protection statement, and the responsible-use policy, in the order an approvals committee asks for them.
Lesson packs
One per module: minute-by-minute running order, what to demonstrate live, the practice set, the gradeable checkpoint, and where the room reliably stalls. Linked from each module below.
Classroom link builder
Produces a URL that opens ctfpal with this challenge already loaded.
Fill in a title or an input to get a link.
The module outline
Copy this into a syllabus as-is, or take the formatted version. Each module links to a student page with objectives, the lesson, the tools, practice challenges ordered by difficulty, and a gradeable checkpoint - and to a lesson pack for teaching it.
- 1.Recognising encodingsFoundation60 min52 challenges
- 2.Classical ciphers and frequency analysisFoundation90 min23 challenges
- 3.Hashes, identification and crackingFoundation60 min13 challenges
- 4.XOR and the cost of reusing a keyCore90 min9 challenges
- 5.RSA and the parameters that break itCore120 min23 challenges
- 6.Web attacks and session tokensCore120 min36 challenges
- 7.File forensics and carvingCore90 min34 challenges
- 8.SteganographyCore90 min29 challenges
- 9.Network forensicsAdvanced90 min17 challenges
- 10.Binary exploitationAdvanced150 min51 challenges
Ways people use it
A full semester
One module per week for ten weeks, with the checkpoint as the weekly deliverable and the practice challenges as homework. The last three modules are heavier and comfortably expand to two weeks each.
A single workshop
Modules 1 to 3 stand alone as a three-hour introduction that takes a room of complete beginners to a solved crypto challenge. No prerequisites beyond a browser.
A competition prep session
Skip the curriculum and use the decision guide directly. It is organised by symptom rather than technique, which is the shape a team needs during a live event.
A lab reference
Point students at the tool index and let them use it alongside whatever material you already teach. Each page is a self-contained explanation of one technique.
Responsible use
Several tools here - the request replayer, the path scanner, the payload catalog, the reverse shell generator, the padding oracle driver - perform active testing against a target the user names. Used against systems the user does not own and has no written permission to test, that is a criminal offence in most jurisdictions, and a student who learns the technique without learning that boundary has been taught badly.
The module on web attacks flags this explicitly, and every relevant tool page repeats it. We would encourage covering it before the tools rather than alongside them.