GPTRiddle
GPTRiddle is a free browser game that casts a large language model as the gatekeeper of a secret key. Across 62 levels, you write the shortest possible prompt that tricks it into giving the key away.
What is GPTRiddle?
GPTRiddle is a browser game in which the opponent is a large language model. Each level hands the model a secret key and an instruction never to reveal it; your job is to write the message that makes it talk anyway. The site describes itself as the escape room game against AI, and the in-game rules state the goal plainly: create the shortest input that retrieves the secret key.
There are 62 levels, running from Waking up through set pieces such as Chatty Parrot, Emoji Madness, Caesar Conundrum and Palindrome Pursuit to a finale called Escape. Each gives the model a different persona, a different opening line and a different generation temperature, from 0.2 to 1.0, so the same trick rarely works twice. Scoring rewards economy rather than persistence: level one is worth 100 points, level two 200, and so on, minus one point for every character you type. A long-winded solution can therefore score worse than a short one.
Playing costs nothing and needs no account, although registering saves your progress and unlocks the ability to buy clues. Accounts use a passwordless magic link sent by email. Sixty-one of the 62 levels have a clue available, bought in packs and spent during play. The profile page also lets you swap the engine: Turbo (gpt-4o-mini) is free and selected by default, while Latest (gpt-4o) requires a one-off unlock payment. A public leaderboard ranks players by total score and can be consulted without signing in.
Technically it is a single-page React application served through Cloudflare Pages: the whole game, privacy policy included, lives in one JavaScript bundle behind an HTML shell of under two kilobytes. A web app manifest allows installation as a progressive web app, but there is no native mobile app and no public API. The publisher, Sliday Limited, is a New Zealand product studio, and the footer credits its Karma team. The privacy policy is explicit that the game exists purely for entertainment purposes.
What it does
- Talk a language model into revealing a secret key it was explicitly told to protect
- Work through 62 levels, each with a different AI persona and generation temperature
- Score points by finding the shortest prompt that works, not merely one that works
- Spend clues on the levels that refuse to give way
- Switch the engine behind the game from gpt-4o-mini to gpt-4o
- Save your progress behind a passwordless, magic-link account
- Measure your total against the public leaderboard
When to use GPTRiddle / When not to
A quick filter to help you decide if GPTRiddle is the right fit.
When to use GPTRiddle
- Curious newcomers who want to watch, first-hand, how a large language model behaves when it has been told to keep a secret
- Prompt engineers after a graded set of 62 guardrails to work around, each with its own persona and temperature
- Security and red-team practitioners who want unpressured practice at prompt injection before meeting it in production
- Teachers and trainers who need a live, zero-setup demonstration of how fragile a system instruction can be
- Puzzle players who enjoy a scoring rule that punishes every wasted character and rewards a single well-aimed sentence
When not to use GPTRiddle
- Teams handling confidential or regulated material: chat logs are stored and no retention period is published anywhere
- Organisations that need a signed data processing agreement, a GDPR statement or a named EU representative before using a service
- Developers hoping for an API: the game's backend is private and carries no public documentation
- Anyone wanting a native mobile app; GPTRiddle is web-only, installable as a progressive web app at best
- Players under 13, whom the privacy policy excludes, and anyone who needs an interface in a language other than English
How to use GPTRiddle
A typical end-to-end flow, from setup to results.
- Open gptriddle.com in a browser; nothing is installed and no account is needed to begin
- Enter a name on the welcome screen and press Begin
- Read the persona the level's AI introduces itself with, then type your attempt in the message box
- Keep the attempt short: every character typed costs one point off the level score
- If the model refuses, rework the framing and try again, or use Retry or Start over to reset the exchange
- Accept the offer of a clue when a level stalls, provided you have clues in stock
- Register when you want your progress kept: enter an email, then click the magic link it sends you
- Buy a pack of clues from the Get clues panel, which hands off to Stripe for payment
- Open Profile to change the AI model, edit your username or Twitter handle, and see your rank and score
- Check the leaderboard to compare your total, with or without an account
Pros & Cons
Pros
- The full 62-level run is free: payments only ever cover optional clues and a stronger model
- No installation, no configuration and no account required to start playing
- The brevity scoring rule turns a novelty into a genuine exercise in economical prompting
- Substantial content for a free game, with real variety between levels
- Purchases are cheap one-off transactions rather than a subscription
- Passwordless sign-in removes the usual account friction
- A public leaderboard gives an honest sense of how good your attempts really are
Cons
- Minimal legal documentation: the privacy policy is a pop-up with no URL and no effective date
- No terms of service for the game exist, even though the privacy policy refers to some
- Chat logs are stored with no published retention period and no described deletion route
- No GDPR mention, no data processing agreement, no subprocessor list and no declared hosting country
- The price of the gpt-4o unlock is never shown before the Stripe checkout
- Entirely dependent on JavaScript: without it the page renders only its title
- English-only interface, no native mobile app, and a single info@ address as the only contact channel
Pricing & Plans
A permanent free plan is available: all 62 levels can be played at no charge, with or without an account. Paid items are optional one-off purchases rather than a subscription. The lowest price point is a pack of 5 clues at USD 2.00, which works out at USD 0.40 per clue; the larger packs are USD 3.00 for 10 clues and USD 5.00 for 20. Unlocking the gpt-4o model is also chargeable, but its price is not published on the site and appears only at the Stripe checkout. No time-limited free trial is offered, as none is needed.
- all 62 levels with the Turbo model (gpt-4o-mini)
- no clues included
- USD 2
- USD 3
- USD 5
- one-off payment
- price not published
Data, GDPR & hosting
A consolidated view of how GPTRiddle handles your data.
GDPR overview
There is no mention of the GDPR anywhere on GPTRiddle. The privacy policy exists only as a pop-up inside the game, with no URL of its own and no effective date, and it never names the regulation; no other page does either. There is no stated lawful basis for processing, no description of access, rectification, erasure or portability rights, no data protection officer, no Article 27 representative for the European Union, no data processing agreement and no list of subprocessors. No hosting country or region is declared. The only commitments made are that data serves to provide and improve the service, that it will not be shared beyond what the policy describes, and that the service is not intended for anyone under 13. The sole contact address is info@gptriddle.com.
Who owns the data?
The privacy policy names Sliday Limited as the operator of gptriddle.com and the party that collects the data. It states that the service gathers your email address and username, stores your chat logs, and records log data such as IP address, browser version, the pages you visit and the time spent on them. Cookies act as anonymous identifiers. The policy allows unnamed third-party companies and individuals to access this personal information in order to facilitate, provide, perform or analyse the service, under an obligation not to disclose or reuse it for anything else. No clause assigns ownership of your prompts or of the model's replies to either side.
Reuse rights
GPTRiddle publishes no terms and conditions of its own, so no document states what a player may do with the text the game produces. The privacy policy, the only legal text available, addresses the publisher's use of your data rather than yours: it limits that use to providing and improving the service, and undertakes not to use or share your information with anyone except as the policy describes. There is no licence grant, no assignment of rights over the prompts you write or the answers the model returns, and no stated restriction on reuse. In the absence of any wording, the position is undefined rather than permissive, and worth clarifying before reproducing game content commercially.
Data retention & training
Hosting summary
GPTRiddle declares nothing about where its data is hosted. Neither the privacy policy nor any other page names a hosting country, a region, a jurisdiction or a cloud provider, and no subprocessor list is published. What can be observed from outside is infrastructure rather than a commitment by the publisher: the front end is served through Cloudflare Pages and resolves to 172.67.199.68, a Cloudflare anycast address indicating a content-delivery node rather than the location of any stored data, while the game's backend runs on a separate host under the publisher's own domain. Sliday Limited is a New Zealand company, but the policy does not say that data is processed there or anywhere else. Anyone who needs a defined jurisdiction for contractual, regulatory or internal-policy reasons should treat the hosting arrangement as undisclosed and ask at info@gptriddle.com before entering anything sensitive.
Things to keep in mind
Risks and trade-offs to weigh before adopting GPTRiddle.
- Prompts are stored: the privacy policy says chat logs are kept, so anything typed out of curiosity or frustration persists on the publisher's servers
- No retention period is published, so there is no stated point at which your conversations stop existing and no described way to have them removed
- Subprocessors are acknowledged but never named, which makes it impossible to know who else can read what you wrote
- The skills the game rewards are the same ones used to jailbreak production systems; practising them here is legitimate, aiming them at systems you do not own is not
- Clue packs are priced low enough to be bought on impulse, which makes repeated small purchases easy to stop noticing
- The leaderboard plus a rule that penalises every character can pull players into long sessions of micro-optimisation with little to show for them
- Beating 62 levels built to be beatable can leave a misleading impression that model guardrails collapse this easily in general
Setup & Integrations
Technical difficulty
Effectively none. GPTRiddle runs entirely in the browser: open the site, type a name and start playing. There is nothing to install, no API key to supply and no settings to configure. An account is optional and, if you want one, it is created by clicking a magic link sent to your email address rather than by choosing a password. The only real requirement is a browser with JavaScript enabled, since the page renders almost nothing without it. A web app manifest is also provided, so the game can be installed as a standalone progressive web app if preferred.
Deployment
Supported languages
Behind GPTRiddle
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
Is GPTRiddle free to play?
What exactly is the objective?
How is the score calculated?
Do I need an account?
How many levels are there?
What do clues cost?
Which AI model does the game use?
Is there a mobile app?
Is there a minimum age?
Are my conversations kept?
Should you pick GPTRiddle?
GPTRiddle is a narrow object and does not pretend otherwise: its own privacy policy calls it a game created purely for entertainment purposes. Judged on that basis, it is well made. Sixty-two levels, each with its own persona and temperature, give the puzzle real depth, and the scoring rule that deducts a point per character typed turns what could have been a novelty into a genuine exercise in economical prompting. Nothing sits behind a paywall: the full run is free, and the paid items amount to a few dollars of optional clues plus a one-off upgrade to a stronger model.
Its value beyond entertainment is real but specific. Anyone who works with language models will recognise the levels for what they are, a graded course in how fragile a system instruction can be and how quickly a refusal collapses under the right framing. Prompt engineers, red teamers and educators introducing AI literacy will take more from it than the scoreboard suggests.
The reservations concern paperwork rather than gameplay. The privacy policy is a pop-up with no URL and no effective date; no terms of service exist for the game at all, despite the policy referring to some; chat logs are stored with no stated retention period; subprocessors are acknowledged but never named; no hosting jurisdiction is declared; and the GDPR is not mentioned once. Little of that matters for a puzzle about a fictional key, and all of it matters the moment a player types something they would rather not have kept.
Recommended to the curious, to practitioners who want a sharper intuition for prompt injection, and to teachers. Not suitable for any professional workflow that touches real data.
- Choosing a selection results in a full page refresh.
- Opens in a new window.