A CTF flag format is the fixed pattern every valid flag in a Capture the Flag event follows, usually an event prefix and a body wrapped in braces, such as CTF7{This_is_an_example_flag}. Organizers publish it in the rules so players can tell a real flag from noise, and so the platform can reject malformed submissions.
Flag format definition
A flag is the secret string that proves you solved a challenge. The flag format is the agreed shape of that string. It has three parts:
| Part | Example | Purpose |
|---|---|---|
| Prefix | CTF7 | Identifies the event, so a flag found in the wild is traceable to it. |
| Wrapper | { } | Marks where the flag starts and ends, even inside binary data or logs. |
| Body | This_is_an_example_flag | The unique part, often a phrase that hints at the lesson, or a random string. |
The format matters most in categories where the flag is hidden among lots of other data: forensics, steganography and cryptography. A known prefix also works as a crib in crypto challenges, which our beginner guide shows in a worked example.
Common CTF flag formats
There is no global standard, but a few conventions cover most events you will play:
| Style | Example | Where you see it |
|---|---|---|
| Event prefix | CTF7{This_is_an_example_flag}, YOURCLUB{...} | Most jeopardy CTFs. The prefix names the event. |
| Generic prefix | flag{...} | Practice challenges, small club events, reused training content. |
| Body only | s3cr3t_v4lu3 | Puzzle-style answers. The rules say whether to add the wrapper yourself. |
| Machine-generated | Fixed-length random string | Attack-defense games, where flags rotate every round and are submitted by scripts. |
In attack-defense, the game server plants fresh flags on each team's vulnbox every round and the checker confirms they can be read back. Organizers publish the flag regex so teams can automate submission. Report-based formats like Raw Ops have no flags at all: findings are submitted as reports and scored after triage.
Validating flags with a regex
A regular expression is the precise way to describe a flag format. Organizers use it to catch malformed submissions and to search writeups or chat for leaked flags. Players use it to search extracted files. A typical pattern:
^CTF7\{[A-Za-z0-9_]{4,64}\}$
^ ... $ anchor: the whole submission, nothing before or after
CTF7 exact prefix (case-sensitive unless you say otherwise)
\{ ... \} literal braces, escaped
[A-Za-z0-9_] allowed body characters
{4,64} body length boundsKeep the character class as narrow as your challenges allow. If a body may contain !, @ or -, add them on purpose. Never allow } inside the body, or the end of the flag becomes ambiguous.
A regex checks shape, not correctness. CTF7{wrong_guess} passes the pattern and still scores nothing. The pattern is a typo filter and a search tool, not the answer check.
Case sensitivity and whitespace
Is ctf7{this_is_an_example_flag} the same flag as CTF7{This_is_an_example_flag}? Only if the rules say so. Pick one policy and publish it:
- Exact match is the most common default. It is predictable, but harsh when a flag is read from an image, audio or lossy output.
- Case-insensitive match suits challenges where case can't be recovered reliably. State it per challenge if it's not event-wide.
- Whitespace: copying from a terminal often adds a trailing newline or space. Decide if the checker trims it, and tell players either way.
Check how your platform compares flags before you write this rule, so the published policy matches what the scoreboard actually does.
Wrapper conventions
- Submit the full string. Most events expect prefix and braces included. If any challenge wants only the body, say so in its description.
- Wrap it yourself. When the answer is a value such as a password, a hostname or a date, rules often say to submit it as
CTF7{value}. Give the exact formatting, for example a date asYYYY-MM-DD. - Readable bodies teach. A static body like
CTF7{0bj3ct_l3v3l_4uth_m4tt3rs}reinforces the lesson. Random bodies are harder to guess and to share by memory. - Brace style is a choice, not a rule. Curly braces are the norm because they rarely appear in ordinary text, but some events use other wrappers. Read the rules.
How organizers choose and announce a flag format
Pick a short, unique prefix
Your event or club name, three to ten characters. Uniqueness helps you search for your flags in public writeups and chat.
Write the regex and the policy
Allowed characters, length, case sensitivity and whitespace handling, in one line of the rules.
Choose static or dynamic flags
A static flag is identical for everyone. A dynamic flag is unique per team (per player in solo events), so a shared flag points to who shared it. CTF7 supports dynamic flags on Standard and Premium events.
Announce it everywhere
In the event rules, on the event page and in every challenge description, plus any exception for a specific challenge.
Test it in playtesting
Submit every flag yourself, including lowercase and trailing-space variants, before launch.
For the challenge-building side (difficulty, packaging and per-team flag generation), see flag formats and dynamic flags in our challenge creation guide. For the wider rules set, see how to host a CTF.
Setting your flag format on CTF7. When you host on CTF7, you set the flag format for your event, for example CTF7{This_is_an_example_flag}, and publish it in your rules and challenge descriptions. Use static flags on any plan, or unique per-team dynamic flags on Standard and Premium. See the platform features or tell us about your event.
Common flag format mistakes
Organizer mistakes
- Format drift:
flag{}in one challenge,CTF7{}in another, usually from reused challenges. - Ambiguous characters such as
l/1/IandO/0in flags read from images. - Unannounced decoys. Fake flags in the real format waste time and cause disputes. If you use them, say so in the rules.
- Unstated case policy, then deciding it mid-event while support tickets pile up.
Player mistakes
- Submitting a trailing newline or space copied from the terminal.
- Dropping the prefix or braces, or adding them when the challenge wants the body only.
- Submitting a flag that matches the format but belongs to a decoy or a different stage of the challenge.
