Login Challenge

Sign in with credentials that are generated fresh every session — never hardcoded, never reused — and shown right on the page, so copy-paste from a previous run won't work. That's the baseline every difficulty shares. From there, each level adds one more real-world login obstacle: a CAPTCHA you have to actually read, and a phone-verified two-factor code you have to fetch from a second, independent page.

What this tests

Easy checks that you can read dynamic values off a page instead of hardcoding them. Medium adds a distorted, noisy CAPTCHA image — solvable with OCR, but not by reading the DOM, since the code is never present as text anywhere in the page source. Hard is the real exercise: the 2FA code lives on a completely separate simulated-phone page, and the login page itself never learns what the correct code is — it only asks a background channel whether what you entered was right. To finish Hard, your automation has to keep two pages open and coordinate between them, the same way a person would glance at their phone mid-login.

Try it with

Any tool that can read pixels and manage more than one browser context: UiPath, Power Automate, Automation Anywhere, or a Playwright, Selenium, or Cypress script. The CAPTCHA is designed to be readable by free, open OCR tooling (for example Tesseract) — it's noisy, not unreadable.

Difficulty levels

• Easy — username + password, standard form.
• Medium — Easy, plus a canvas CAPTCHA that regenerates on a wrong guess.
• Hard — Medium, plus a 60-second, phone-verified 2FA step on a second tab.

Tips

Watch for the 3-attempt lockout — three wrong submissions locks the form for 10 seconds, same as most real login systems. On Hard, open the phone page in a separate tab or window and keep it open; the OTP screen can't verify anything if it can't reach it.