Free Cyber Security Games

The best ones teach habits you'll use in real life and are fun enough to play again. The games on this page are free online cybersecurity games from CanIPhish, a phishing simulation and security awareness training company. They range from defense and action games to strategy games and simulations, and in every one you win with real security habits and controls. A run takes about 10 to 15 minutes, and every game has its own top-50 leaderboard.

Yes. Every game here is completely free, with nothing to download and no account to create. They run in any modern browser. You only choose a gamer alias if your score makes the top 50 and you want it on the leaderboard.

Short, replayable games work best at work, because people can finish a run over a coffee break. A run takes about 10 to 15 minutes, and the moves that win stand for habits your security policy already asks for: unique passwords, multi-factor authentication, updates, backups and reporting phishing. Some games also show the security team's side, so people see why those policies exist. Run a friendly leaderboard challenge during security awareness month, or assign the games through CanIPhish to track who has played.

Yes. The cartoon villains, plain-language tips and no-account play make them a safe pick for classrooms, coding clubs and families. Each game is labelled Beginner or Intermediate: the Intermediate games have more reading and workplace scenarios, so they suit teens and older students, including anyone curious about a career in cyber security. Students learn the same habits adults need, such as pausing before they click and thinking before they share. Younger kids may want a grown-up nearby to help with the reading, and nobody needs to share personal details to play.

Everyday habits that stop real scams: using strong, unique passwords and passkeys, turning on multi-factor authentication, pausing before you click, spotting phishing and deepfake scams, reporting anything suspicious, installing updates, securing your home Wi-Fi and thinking before you share. Some games also show the other side: how a security team layers real controls to stop attacks, and how a security champion builds a culture where people report scams. Along the way, bonus questions and real-life decisions check what you've picked up.

People remember what they practise, so the games turn real security habits and controls into the moves you make under pressure, and their villains stand for real threats, from phishing and stolen passwords to ransomware and deepfakes. The games reward the choices that work in real life: layering defences instead of relying on one, pausing to check before you act, and reporting a phish instead of opening it. Plain-language tips along the way tie each lesson back to real life.

Each game has its own leaderboard of the top 50 players of all time. When a run finishes in the top 50 you can claim your spot with a gamer alias of 2 to 15 characters. You hold one spot per game and your best run counts. Scores are checked for plausibility before they're saved, and aliases are screened to keep the board friendly.

Yes. The games run in any modern browser, and they're at their best on a laptop or desktop. Most use 3D graphics (WebGL), so keep hardware acceleration turned on. On a phone, tap Play to open the game full screen. Some games ask you to turn your phone sideways; each game's page has the details.

Yes. All of these games are part of the CanIPhish training library, so you can assign them to employees, track completions, run private leaderboards and pair them with phishing simulations. You can start with a free account.

No account or email is needed. When you claim a leaderboard spot, we keep your alias, your score and the run's details (how far you got, how long it took and the date), a random ID for this browser, and a scrambled code derived from your network address. That code is used only to stop one network filling the board, and it is never shown. If you're signed in to a CanIPhish account when you claim a spot, or later sign in on the browser you claimed it on, we also keep that random ID with your account, so your alias follows you to any browser you sign in on. The leaderboards are all-time, so an entry stays until it drops out of the top 50. To have an entry removed, contact support@caniphish.com. Your alias is public, so please don't use your real name.