How much of a secret will you give up to test it? The Courier checks a sample of a possible key, then delivers or discards the untested bits. The Spy chooses how many signals to intercept and how to measure them. More evidence costs key; more listening risks detection.
Set up
Open the game on one phone, tablet, or computer. To play offline, download the game’s HTML file while online, then open it in a browser that supports local files.
Choose Solo Courier, Solo Spy, or Pass & Play. For two players, use one Courier and one Spy. With three, two Couriers share choosing tests and making the delivery decision.
Begin with Calm Night. After one shift, try Noisy Night, which adds a 6% independent probability of flipping each of Bob’s detector readouts.
In group play, keep the Spy’s screen private. The handoff screen covers the plan before the phone changes hands. This is one-device play using an honor system. Swap roles after four packets.
Run one packet
Spy plans. Choose to intercept 0, 10, 20, or all 40 signals, measuring each in random Z/X bases, always Z, or always X. Eve has no access to Alice’s or Bob’s basis at this point. Solo Courier uses a hidden computer plan.
Compare bases. Alice prepared a random bit in a random basis for each signal. Bob independently measured each in a random basis. They publicly compare bases and keep only matching positions—usually about half.
Test a sample. The Courier taps envelopes to publicly compare Alice’s and Bob’s bit values. Every tested bit is removed from the possible key. Test at most eight, leaving at least one untested bit. Testing is optional.
Deliver or discard. Compare points, read the hidden story, and optionally expand the replay. In Solo Spy, the computer announces its sample size before Eve plans, tests random retained bits, and discards on any mismatch.
Play four packets. The higher total wins. A tie is possible. Each packet is a fresh exchange, so a previous packet’s replay does not reveal the next plan.
Scoring
Outcome
Courier
Spy
Deliver a correct bit Eve does not know
+1 per bit
0
Deliver a bit Eve knows or Bob reads incorrectly
−2 per bit, counted once
+2 per bit Eve knows
Discard after finding a mismatch
+4 per packet
0
Discard without finding a mismatch
0
0
Publicly tested bits are excluded from delivery scores. An exposed bit and an incorrect bit can be the same position; it receives only one Courier penalty. The bonus rewards finding disturbance, even when noise caused it.
Try a prediction in the Signal Lab
Use the game’s Signal lab button. Each run repeats a chosen preparation 200 times; it does not measure one unchanged qubit 200 times.
Prepare bit 0 in Z; Bob measures Z; Eve stays off. Predict Bob’s outcomes. Every ideal result is 0.
Keep Alice in Z and switch Bob to X. Predict the pattern. Results fluctuate around half 0 and half 1.
Return Bob to Z and let Eve measure in X and resend. Predict again. Bob’s results now fluctuate around half 0 and half 1.
Let Eve measure in Z instead. Why do Alice and Bob agree again? Discuss why Eve does not know the right basis in the actual game.
Discuss after a shift
Did you keep testing after finding a mismatch? What did another test cost, and what could it tell you?
Can eight matching tests prove that nobody listened? What did the hidden replay show?
On Noisy Night, can a mismatch identify Eve? What extra evidence would you want?
Which listening plan worked best for you? Would it still work against a Courier who tests a different number of bits?
The model and its limits
The simulation implements ideal preparation and projective measurement of the four BB84 states in the Z and X bases. A measurement in the preparation basis returns that bit; the other basis returns a random bit. Eve’s chosen subset is intercepted without knowing the bases. She measures, prepares the measured state, and forwards it to Bob. Sifting uses Alice/Bob basis agreement.
For a full random-basis intercept-and-resend attack on the ideal line, Eve uses the wrong basis half the time and Bob then disagrees half the time: 25% average error among sifted bits. Small samples can miss these errors. The additional detector noise is an independent classical readout flip, not a full optical channel model.
Eve’s “known” bits are those measured in Alice’s basis; other guesses are not scored as knowledge. The simulator reveals its records only after the decision to explain points. It excludes photon loss, imperfect sources, general attacks, and real security calculations.
Game points and per-bit labels are teaching rules. The phone simulates quantum states; it does not exchange qubits or generate a real secret key. Real QKD also needs an authenticated classical channel, error reconciliation, privacy amplification, and finite-key security analysis. A clean game sample is never presented as proof of security.