A dynamic flag is a CTF flag generated separately per team (per player in solo events), so no two teams receive the same answer to the same challenge. Because every flag has exactly one owner, a flag that shows up in the wrong team's submission reveals where it came from. That makes flag sharing detectable, and therefore far less tempting.
How dynamic flags work
Every dynamic-flag system has three moving parts.
- Generation. The platform produces one flag per challenge per owner (a team, or a player in solo events). It can store a random value for each owner, or derive the value from a server-side secret with a keyed hash, so the server can recompute any team's flag without keeping a table. Either way, the value must be impossible to predict from another team's flag.
- Delivery. The flag has to reach the right team inside the challenge. Common approaches are injecting it into a challenge instance when it starts, building a per-team copy of a downloadable file, or having a service return the requesting team's flag once the puzzle is solved.
- Checking. When a team submits, the platform compares the value with that team's own flag. A match scores. A mismatch that equals another team's flag is not just "incorrect": it is a sharing signal worth logging and reviewing.
From the player's side, nothing looks different. The flag format stays the same, for example CTF7{…}, and only the value inside the braces varies. For the full guide to generating per-team flags, reading submission logs and building an anti-cheat policy, read Dynamic Flags and Anti-Cheat: How to Keep Your CTF Fair.
Dynamic flag vs dynamic scoring. The names are similar, but they solve different problems. Dynamic scoring lowers a challenge's point value as more teams solve it. A dynamic flag changes the answer itself. An event can use either, both or neither. Our guide to CTF scoring covers the points side.
Static flag and dynamic flag compared
A static flag is one string shared by everyone who solves the challenge. A dynamic flag is issued per owner. The trade-off is simplicity against traceability.
| Aspect | Static flag | Dynamic flag |
|---|---|---|
| Who receives it | Every solver gets the same value | Each team (each player in solo events) gets its own value |
| Setup effort | Low: write it once, paste it into the challenge | Higher: generation, per-team delivery and testing |
| Downloadable files | One file for everyone | Needs a per-team copy, or the file stays static |
| If it leaks | A copied submission looks like a genuine solve | A copied submission is rejected and names the source team |
| Evidence for disputes | Circumstantial (timing, IPs) | Direct (the flag belongs to someone else) |
| Best for | Practice events, small closed groups, low stakes | Prize events, qualifiers, hiring CTFs, large open CTFs |
Many events mix the two: a forensics image may stay static while instance-based challenges carry dynamic flags. Just track which is which when you read your logs.
Why a shared flag stops working
With static flags, sharing is cheap and nearly invisible. With dynamic flags, a copied flag earns nothing for the receiving team, and the submission names the team it was issued to, so the giver carries risk too. The deterrent works best when players know about it, so say in your rules that flags are unique per team.
Dynamic flags stop copied answers, not shared methods, and they do nothing about AI assistance, which is a policy question (see should your CTF allow AI?). For submission logs, rate limits and writing a policy, read our guide to dynamic flags and CTF anti-cheat.
Before you turn them on
- Decide challenge by challenge. Instance-based challenges are the easiest to make dynamic. Static files need per-team builds, and some puzzles only make sense with one fixed answer.
- Keep the secret server-side. Whatever produces the flags must never ship inside a challenge image or handout. Our guide to creating CTF challenges covers flag handling during the build.
- Test with two accounts. In your dry run, confirm that team A's flag is rejected for team B and logged.
Attack-defense CTFs take the idea further by design. Flags are planted in each team's vulnbox and replaced every tick, while a checker confirms services still work. See attack-defense CTF for how that format runs.
Dynamic flags on CTF7 (Standard and Premium). Dynamic flags unique per team (per player in solo events) are available on the Standard and Premium plans, together with anti-cheat monitoring. The Free plan uses static flags. Compare plans, or tell us about your event and we will help you set it up.
Related terms
Browse the full CTF and cybersecurity glossary for more terms.
