Untrusted

Overview

The first room loads with its own source code staring back at you. Down in the editor pane sits the startLevel function that just generated the grid above — its walls, its exit teleporter, and Dr. Eval, the figure you must walk to that exit. Every level ships unwinnable on purpose, and the few lines the game leaves editable are your only tools. Untrusted, by Alex Nisnevich and Greg Shuflin, is a meta-JavaScript adventure that treats the running code as the puzzle: edit it, re-execute it, and the world re-renders to match. Built on Ondřej Žára's rot.js engine and Marijn Haverbeke's CodeMirror, it teaches a small real API — map.placeObject, map.getPlayer, player.move — then dares you, a few rooms later, to break the very rules it just taught. It rewards anyone who can already read JavaScript and teaches the rest one edit at a time, which is why it has become a rite of passage for developers who want a puzzle that fights back with the same language they ship in.

How to Play

Each level opens on a top-down grid with Dr. Eval under your control and an exit you cannot legally reach. The arrow keys walk him one tile at a time, Q raises the in-game phone for a hint, and the code lives in the pane below. Inside the editable region the game has left unlocked, you write real JavaScript: nudge the exit by calling map.placeObject at fresh coordinates, delete a blocking wall, or, a few rooms on, overwrite a built-in such as Math.random to rig the outcome. Press Ctrl+5 to execute the modified level, Ctrl+4 to reset a room you have broken, Ctrl+2 to swap focus between editor and game, Ctrl+1 to open the API reference, and Ctrl+0 to return to the menu. The loop is tight: read the level, edit the function, run it, and watch the world re-render under your change.

Tips & Strategy

Read the editable lines first, not the whole file — the locked code is scenery, and the solution always lives inside the region the game has marked open. Run a level unmodified before changing anything, so you can see exactly which rule is killing you; often the level's title is already naming it. Press Q for the phone hint once you understand the mechanic but not the trick, not as a first resort, because the hint gives away the insight and short-circuits the puzzle. Keep the notepad (Ctrl+3) handy for coordinates and object names, since later rooms chain several API calls and a typo in the second one silently breaks the fourth. When a level exposes Math.random, Array methods, or the game's own validateMove, remember the exploit can be global — forcing a validation function to return true clears rooms that look unrelated. Reset freely with Ctrl+4; re-running half-broken code is how the editor eats your afternoon.