STATUS: SEALED
UNHACKABLE
VAULT
Nobody has gotten in. Think you can?
THE RULES
- Test only unhackablevault.com and its subdomains. Nothing else is in scope.
- No denial-of-service or high-volume flooding.
- Never enter a real password. Use throwaway values.
WHAT THIS IS
This is a security research honeypot. The vault holds no real data, any credentials you find are fake, and there is no prize. Attempts appear on a live screen used in security awareness demonstrations.
We log the request path and method, browser identifier, network name, and approximate location (about 50 km). IP addresses are stored only in partial form, with a salted hash to group repeat attempts. From login attempts we keep usernames and passwords found on common lists; otherwise, only a username's first character and a password's length (up to 8). Request bodies are not stored. Request paths may be sent to an AI service to generate explanations.