The inbox, Monday 8:47am
Six emails arrived overnight. Open each one, then decide: report it as phishing, or treat it as legitimate. A real employee makes this call under time pressure. You have all the time you want, so use it to look for the cues they wouldn't have time to check.
Select an email on the left to review it.
Password & Hashing Lab
This lab lets you see how hashing and password strength work, live.
The SHA-256 hashing here is a from-scratch JavaScript implementation
of the FIPS 180-4 algorithm, not the browser's built-in
crypto.subtle API, so every hash you see on this page
is computed by this page's own code. Nothing typed here leaves this
page.
Weak & reused
Four-word passphrase
Why salting matters
Hash the word "password123" twice — once plain, once with a random salt attached before hashing. Same input, very different stored value.
MFA Fatigue Test
You're closing out a busy shift when login-approval prompts start arriving, back to back. Approve or deny each before the bar runs out. One of the six is not you.
Six approval requests are about to arrive at the company's admin portal, each one a little faster than the last — just like a real MFA-bombing attempt.
Session Log
Every decision from all three modules, in order, with its effect on the Human Risk Index. Review your choices here, or start over with a clean session.