How Password Lab turns one password into a puzzle
Password Lab is a progressive browser game built around 24 cumulative rules. You begin with familiar requirements such as length, uppercase and lowercase letters, a number, and a symbol. Each successful step unlocks a more unusual condition: a daily vault code, a cosmic word, a digit checksum, a palindrome, an emoji, matching brackets, a riddle answer, a reversed code, and a final character limit. The challenge is not only solving the newest rule. Every previous rule must remain valid as the fictional password changes.
The game checks the entire active rule stack after every edit. Green cards are currently correct, while red cards need attention. If a rule that previously passed becomes invalid, it immediately becomes the highest-priority rule, moves to the top, flashes red, and displays a Repair First label. This prevents an older broken requirement from disappearing inside a long list. Once every visible condition passes again, the next rule appears.
A mobile layout designed around the keyboard
On smaller screens, the rule that needs attention is shown directly above the password field. You can read the requirement, type, and watch its status change without scrolling away from the mobile keyboard. Completed rules remain in the history stack below the editor. When an earlier rule breaks, that rule replaces the current mobile card above the input, so the problem that blocks progress is always visible. Desktop users retain the wider two-column layout with the editor beside the full rule stack.
Tricky, but generated to remain solvable
The daily values are not combined blindly. Before a puzzle is shown, the game constructs a complete internal solution containing every required word, number, separator, symbol, and ordering condition. The displayed digit target is calculated from that finished solution, including numeric rules that appear later. Therefore a target such as 44 can still work after the odd sequence, vault code, reversed code, colour fragment, and year digits have been added. The digit sum and password length are separate rules: the sum may be 44 while the finished password remains anywhere inside the allowed 38-to-64-character window.
Daily puzzles are deterministic, while New Puzzle creates another valid variation. Generated combinations are checked against all 24 validators, including the vowel minimum, five distinct digits, checksum, code order, unique-character requirement, and final exclamation mark. There is always at least one known route to completion, although players are free to build a different valid password.
Hints, strategy, scoring, and privacy
Use hyphens to divide the password into readable sections. Keep the original vault code before its reversed form, expect to adjust the checksum when later number fragments appear, and avoid shortening the text too early. Live metrics show length, digit sum, unique characters, and puzzle complexity. Every failing card has an optional hint, but hints lower the final score. Completion records time, length, edits, hints, score, and rank without including the password in shared results.
This is an entertainment puzzle, not a security test. Never enter a real password or reuse the final text on an account. The fictional entry is not sent to a server. Session recovery stays inside the current browser tab, and restarting or completing the run clears it. The tool uses bounded input, one lightweight timer, and temporary celebration effects so long attempts remain responsive on desktop and mobile devices.