Skill Challenges

3-minute drills that sharpen the developer skills you actually use.

Runs locally in your browser No login. No backend. Daily & practice modes

Your progress, streaks, and badges are stored locally in this browser. They are not uploaded.

Skill of the day

All challenges

  • Regex Rescue — Build or choose the right regex to match valid strings and reject invalid ones.
  • API Detective — Find the bug in an API request/response: status codes, headers, JWT, CORS, and more.
  • Payload Patch — Pick the right transformation to fix a broken JSON payload.
  • JSONPath Quest — Pick the JSONPath expression that returns the target output.
  • Diff Detective — Spot the meaningful change between two snippets that may break consumers.
  • JWT Heist — Identify what's wrong with a JWT — alg=none, expired, aud mismatch, RS↔HS confusion, and more.
  • Cron TimeLock — Pick the cron that matches the intent, or spot the bug in the given cron.
  • CSV Sleuth — Find the missing or duplicated row between two CSV snapshots.
  • Dockerfile Watch — Pick the dangerous or non-reproducible line in a Dockerfile snippet.
  • SQL Join Maze — Pick the SQL join that produces the target result set.
  • Secret Hunter — Spot the leaked secret in a config or code snippet.
  • Signature Forensics — Pick the reason this webhook signature verification failed.

Your local progress

How to practice effectively

Pick one challenge that matches the artifact you are already working with: JSONPath for API responses, Diff Detective for regressions, Secret Hunter for config review, or Cron TimeLock for scheduled jobs. Solve the prompt first, then open the matching tool and repeat the same reasoning on a safe sample from your own workflow.

What each result means

  • Correct: you identified the important signal and can apply the same check in the related tool.
  • Close: review the explanation and compare the candidate outputs again; most misses are caused by one overlooked field or header.
  • Needs practice: replay the challenge with a different seed, then use the linked tool to inspect a real example locally.

All challenge progress is stored in this browser. Use sanitized examples when moving from a challenge into a real tool.

Practice notes for real projects

Use this page as a warm-up before touching real project data. Read the prompt, write down the signal you are looking for, and only then compare answer choices. That habit carries over to production debugging, where the first visible error is often a symptom rather than the root cause.

After the challenge, recreate the same pattern in the linked tool with a harmless sample. For example, replace real tokens, user identifiers, hostnames, and request bodies with safe values, then verify that the same reasoning still works. This keeps practice useful without exposing private data.

  • Save time by checking the smallest artifact that reproduces the issue.
  • Write one sentence explaining why the wrong answers fail; that explanation is the skill to reuse later.
  • If the challenge involves security, treat decoded or inspected data as untrusted until a separate verification step confirms it.