hacker101.com

Hacker101 is a free web security class from HackerOne. It combines video lessons, written guides, and hands-on Capture the Flag (CTF) levels, and it is aimed at anyone from a programmer curious about bug bounties to a seasoned security professional. If you want structured, self-paced material that moves from concepts to practical exploitation, it is a reasonable starting point. If you need formal certification, instructor-led pacing, or a syllabus mapped to a specific exam, look elsewhere.

What you actually get

The site organizes its content around two main entry points, plus supporting material:

• Video Lessons — free classes covering web security topics, with guides and resources alongside them.
• Capture the Flag — CTF levels described as "inspired by the real world," intended for putting skills into practice.
• Guides and resources — reference material that accompanies the lessons.

The stated audience is broad on purpose: the same platform is pitched at people who write code and want to try bug bounties, and at people who already work in security.

How the two halves fit together

The design assumes you alternate between learning and doing:

1. Watch or read a lesson to pick up a concept — for example, how a class of input handling flaw arises.
2. Attempt the related CTF level to apply it against a target you are allowed to attack.
3. Return to the guides when you get stuck, then retry.

The CTF levels are the part that distinguishes Hacker101 from a pure video course. Because they are modeled on real-world scenarios, the skills transfer more directly to bug bounty work than puzzle-style challenges that reward trivia.

Who should use it

Practical things to know before starting

• It is free. The site describes itself as "a free class for web security," and the lessons, guides, and CTF are presented as free resources.
• It is self-directed. There is no stated schedule, cohort, or completion requirement, so you set your own pace and decide when a topic is "done."
• The CTF is the core practice loop. Treat the videos as preparation for the levels rather than the end goal; the levels are where the real-world framing pays off.
• Expect to get stuck. That is normal for CTF-style learning. The intended recovery path is the accompanying guides and lessons, not brute-forcing a single level for hours.

A sensible first session

If you are deciding whether to commit, spend one sitting like this:

1. Open the Video Lessons section and pick one topic you already half-understand.
2. Watch it, then immediately open the CTF section and try a level that touches the same idea.
3. Note where you stall. If the stall is "I don't know this concept," the lessons are working as intended. If the stall is "I can't write the code at all," you may want to build basic programming and web fundamentals first.

That single loop tells you more about fit than reading any description, including this one.

Hacker101's Capture the Flag (CTF) is a set of practice levels you play directly on the Hacker101 site, built to apply what you learn in its web security lessons. It suits you if you're a programmer curious about bug bounties, a student learning web security, or an experienced professional who wants realistic practice. The site describes the CTF as "levels inspired by the real world," so expect challenges modeled on real web vulnerabilities rather than abstract puzzles. It's a practice environment, not a competition platform with published rankings or prizes.

What the CTF is for

The CTF sits alongside Hacker101's video lessons as the hands-on half of the class. The lessons explain concepts; the CTF levels give you a target to test them against. The site frames it as "put your skills into practice," which tells you the intended workflow: learn a technique, then find and exploit it in a level.

This makes it a reasonable fit if you want structured practice with real-world flavor. It's a weaker fit if you're looking for timed competitions, team brackets, or a scored leaderboard — the site's own description points to self-paced levels, not organized events.

How a typical session works

The exact interface and level list live on the site, so treat the steps below as the general shape rather than a fixed menu path:

1. Start from the Hacker101 site. The homepage presents two main entry points: Capture the Flag and Video Lessons. Choose the CTF.
2. Pick a level. Levels are the unit of practice. Each one presents a target — typically a small web application or page — with a vulnerability to find.
3. Reconnaissance. Explore the target as a normal user would: look at pages, parameters, inputs, and responses. This mirrors how you'd approach a real web app.
4. Identify the vulnerability. Match what you observe against the classes of bugs covered in the lessons (for example, injection, access control, or authentication flaws).
5. Exploit it to capture the flag. Success means retrieving the flag — a string that proves you solved the level. Submitting it marks the level complete.
6. Move to the next level. Levels build on each other, so the skills compound as you go.

The expected result of each level is the same: you demonstrate that you can find and use a specific vulnerability, not just recognize it in a quiz.

What you need before starting

• A web browser. The CTF runs in the browser; no special tooling is required to begin.
• Basic web literacy. Understanding HTTP requests, URLs, cookies, and HTML helps you read what the target is doing.
• Willingness to use developer tools. Browser dev tools and an intercepting proxy are the standard way to inspect and modify traffic, which is how most levels are solved.
• The lessons, ideally first. Since the CTF is designed to apply the class material, working through the relevant video lessons makes the levels far less opaque.

How to tell if it fits your goals

Common sticking points

• Getting stuck with no hint. CTF levels are meant to be figured out. If you're blocked, revisit the matching video lesson rather than hunting for a walkthrough — the lesson usually contains the technique you're missing.
• Skipping the lessons. Jumping straight into levels without the class material makes the vulnerabilities harder to spot, since you won't yet know what to look for.
• Assuming fixed rules. The number of levels, their difficulty, and any scoring or submission rules are set by the site and can change. Check the CTF page itself for the current setup rather than relying on secondhand descriptions.

The bottom line

Use Hacker101's CTF if you want hands-on, real-world-flavored web security practice that pairs with free lessons. Start with the lessons, then work the levels in order, using browser dev tools to inspect and manipulate the targets. If you want ranked competitions instead of self-paced practice, this isn't that — but as a practice loop for web security skills, it's a direct fit.

Yes. Hacker101 describes itself as "a free class for web security," and its homepage lists no prices, paid tiers, or payment platforms. The two main learning paths shown on the site — Video Lessons and Capture the Flag (CTF) levels — are presented as freely available. The site's own description says it is for "a programmer with an interest in bug bounties or a seasoned security professional," which indicates the free material is meant for a range of experience levels, not a paid audience.

What the site says about cost

The homepage heading is "LEARN TO HACK," and the excerpt states directly: "Hacker101 is a free class for web security." It also invites visitors to "Start hacking!" with no mention of a fee, subscription, or purchase step. The page evidence contains no pricing keywords, no pricing links, and no payment platforms, so there is no indication on the page of a paid option at all.

What you get for free

The phrase "Explore free classes" is the clearest confirmation that the class content itself is offered at no charge.

What is not confirmed

The available page evidence does not state whether you need an account to access lessons or CTF levels. It also does not describe any limits, gating, or optional paid services. Because the site doesn't mention these details, treat any account or registration requirement as something to check during the actual sign-up flow rather than assuming one way or the other.

How to start

1. Go to hacker101.com.
2. Choose a path: "Check out CTF" to practice with challenge levels, or "Explore free classes" for the video lessons and guides.
3. Follow the site's own prompts if it asks you to create an account or log in.

The expected result is access to web security lessons and hands-on CTF challenges without a payment step, based on how the site presents itself.

Bottom line

If your question is whether Hacker101 costs money, the site's own description answers it: it is a free class for web security, with free video lessons and CTF levels. No pricing or payment information appears on the homepage, so there is nothing to suggest a paid requirement for the core learning content.

Hacker101 is a free web security class aimed at two broad groups: programmers who are curious about bug bounties, and experienced security professionals who want to sharpen their skills. If you fall into either category — or you're a motivated beginner willing to work through hands-on challenges — it's worth starting with the free video lessons and then testing yourself in the Capture the Flag (CTF) levels. If you need a structured, credentialed course with deadlines and grading, this isn't that; Hacker101 is self-paced and practice-driven.

Who gets the most out of Hacker101

The site describes its audience directly: "Whether you're a programmer with an interest in bug bounties or a seasoned security professional, Hacker101 has something to teach you." That points to three practical learner profiles.

Programmers eyeing bug bounties

You already write code and understand how web applications are built. What you likely lack is the attacker's mindset — how input handling, authentication, and access control actually break. Hacker101's CTF levels are described as "inspired by the real world," which makes them a reasonable bridge from writing software to finding its flaws.

Experienced security professionals

If you already work in security, the value is less about fundamentals and more about reps: varied challenges and lessons that keep your skills current. The material is broad enough that the site positions it as useful even for people who do this professionally.

Beginners willing to learn by doing

Hacker101 doesn't gate itself behind prerequisites, and the lessons are free. But the format rewards self-direction. A beginner who wants guided instruction with a teacher checking their work will find the CTF format demanding; a beginner comfortable reading, experimenting, and getting stuck will get more out of it.

What you actually do inside Hacker101

The homepage organizes the experience around two entry points, and understanding the difference helps you decide where to start.

A sensible sequence is lessons first, then CTF. The lessons give you vocabulary and mechanism; the CTF forces you to use them under uncertainty, which is closer to how real bug hunting feels.

How to tell if it fits you

Ask yourself these questions before committing time:

• Do you want to find bugs, not just read about them? The CTF is the core practice loop. If hands-on challenge-solving sounds tedious rather than motivating, the format will fight you.
• Are you okay being self-paced? There's no indication of cohorts, schedules, or instructor feedback. You set the pace and diagnose your own gaps.
• Is "free" the deciding factor? The site presents itself as a free class. That removes cost as a barrier, but it also means you're trading money for the discipline of finishing on your own.
• What's your goal? If it's "understand how web vulnerabilities work and practice exploiting them," the lessons-plus-CTF structure matches. If it's "earn a certificate for my résumé," check what the site actually offers before assuming — the homepage emphasizes learning and practice, not credentials.

A concrete way to start

1. Open the Video Lessons section and work through the free classes to build baseline concepts.
2. Move to Capture the Flag and attempt levels in order, treating each as a real-world scenario.
3. When you get stuck, return to the relevant lesson rather than hunting for the answer — the goal is the skill, not the flag count.

If after a few CTF levels you find yourself consistently engaged rather than frustrated, Hacker101 is a good fit. If you keep wishing someone would just explain the answer, you'd likely do better with a more guided course first, then come back.

Hacker101 offers four main learning resources: free video lessons, written guides and resources, Capture the Flag (CTF) practice levels, and free classes. All of them live on hacker101.com and are described on the site as a free class for web security, aimed at both programmers interested in bug bounties and experienced security professionals. If you want structured instruction, start with the video lessons and classes; if you want hands-on practice, go straight to the CTF levels.

Video Lessons

The site's "Video Lessons" section is the core instructional track. According to the homepage, it contains "free video lessons, guides, and resources" that teach you how to hack. This is the best entry point if you are new to web security or bug bounties, because the material is organized as a class rather than a loose collection of clips.

Guides and Resources

Alongside the videos, Hacker101 groups written guides and other resources into the same learning path. These are useful when you want to review a concept at your own pace, look something up while working through a challenge, or revisit material without rewatching a video.

Capture the Flag (CTF)

The CTF section is where you apply what you have learned. The homepage describes these as "CTF levels inspired by the real world," and the call to action is simply "Start hacking!" This is the practice layer of Hacker101: instead of only watching or reading, you work through challenges that mirror real-world web security scenarios.

Free Classes

The "Explore free classes" entry point ties the instruction together. It is the navigation route to the class content, so if you are unsure where to begin, this is the link to follow first.

Which resource should you start with?

A practical sequence is to begin with the video lessons, use the guides as reference while working, and then move to the CTF levels to test yourself. The site presents all of this as free, and it is designed to be useful whether you are a programmer exploring bug bounties or already working in security.