Not everything on a web page is meant to be seen by visitors. Developers sometimes leave notes in a page's source code — and if those notes contain anything sensitive, anyone can find them. This exercise teaches how to view a page's source code and decode a simple obfuscation technique called Base64.
This login page is not fully built yet. Please check back later.
There is a hidden note somewhere in this page's underlying code. Try one of these:
Ctrl + U on Windows/Linux,
Cmd + Option + U on Mac).<html>
for an HTML comment (comments look like
<!-- text -->).The comment contains a long string of letters and numbers — that's a message encoded using Base64, a common way to turn text into a different-looking block of characters. It isn't encryption and isn't secret, just disguised — which is exactly why security teams check for it. Paste the whole encoded string into any online Base64 decoder (search "base64 decode online") to reveal a short internal memo. Read it carefully — the flag is written inside it.
Developers occasionally leave comments containing test passwords, internal URLs, or API keys in code that ends up published live. Security professionals routinely check a site's source code for exactly this kind of accidental leak — it's a real, common finding in security reviews.