Expert Overview

picoCTF, run by Carnegie Mellon University’s CyLab Security and Privacy Institute since 2013, is a free online capture-the-flag contest in which students solve security challenges in forensics, cryptography, reverse engineering, and web security. More than 18,000 people compete in the annual event, with a separate leaderboard for U.S. middle and high school students.

Format

Individual, Team

Judging Format

Scoring based

Monetary

Opportunity

Grade Eligibility

Rising Freshmen, Sophomores, Juniors, Seniors

Geographic Eligibility

International

Discipline

Computer ScienceCybersecurity

Entries

~18,000

Percent Awarded

<1%

Important Dates

Registration Opens

February 1, 2026

Registration Deadline

March 16, 2026

2026 Competition

March 9 - March 19, 2026

Passed

Open

Approaching: < 1 mo.

Priority: < 2 weeks

Urgent: < 1 week

Registration Cost

No entry fee

About

Participants register before launch, play individually or in teams of up to five, and capture flags in challenges that grow harder as the event proceeds; every flag earns the same points regardless of solve speed. Anyone may play, but the U.S. Middle/High School leaderboard is for U.S. students. Challenges are written by Carnegie Mellon faculty, staff, and students, including its DEF CON CTF-winning hacking team.

Scale is not the signal here: with more than 18,000 participants across ages, entering is not distinctive. The credential is rank on the U.S. Middle/High School leaderboard, a field of roughly 4,400 students in a recent year, and because speed adds no points, rank reflects how many challenges a team solved. Carnegie Mellon announces the top three teams each year.

picoCTF is the right competition for a student of any experience level who wants to learn cybersecurity by doing — free to enter, no programming background required, and with a Carnegie Mellon-hosted leaderboard that tests the skill against thousands of peers.