Rules Overview
Game design: David McDougal
3–4 Players (3 optimal)
Standard 52-card deck + 2 Jokers
30min Playtime
Age 8+
Set Collection, Race, Take-That
Objective
Build your Password, complete your 2FA, then find the exposed Verification card needed to authenticate your Goal.
Other players' exposed cards may help you Verify, but taking one can break their Password or 2FA.
The game ends after a round in which at least one player reaches 25 points.
Goal Levels
Each Goal card lists its Password, 2FA, Verification requirement, and scoring.
L1: Password 4 cards, 2FA 3 cards, Verification 1 card. Scores 1 / 1 / 1 = 3
L2: Password 5 cards, 2FA 3 cards, Verification 1 card. Scores 1 / 1 / 2 = 4
L3: Password 6 cards, 2FA 4 cards, Verification 1 card. Scores 1 / 2 / 4 = 7
L4: Password 7 cards, 2FA 4 cards, Verification 1 card. Scores 2 / 3 / 5 = 10
L5: Password 8 cards, 2FA 4 cards, Verification 2 cards. Scores 3 / 4 / 6 = 13
You may complete each Goal Level only once per round.
Completing an L3, L4, or L5 Goal immediately ends the round.
Setup
- Shuffle the playing deck and Goal deck separately.
- Deal 2 Goal cards to each player. Each player keeps 1 and discards the other.
- Deal 8 playing cards to each player.
- Place the remaining playing cards face down as the draw pile.
- Leave room for a face-up, splayed discard pile.
The player who most recently used two-factor authentication goes first. If unsure, choose randomly.
The hand limit is 7 cards, checked only at the end of a normal turn.
Your Turn
Choose either a Normal Turn or a Reset Turn.
Normal Turn
1. Draw or Recover
You must do one of the following:
- Draw 1 card from the draw pile.
- Take 1 exposed card from the discard pile into your hand.
- Take multiple cards from the discard pile, provided every card taken can be immediately and legally placed into your current Goal.
2. Play
You may play cards from your hand into your Password or 2FA.
No more than 2 cards total may be added or moved into your player area during a turn.
This includes cards:
- played from your hand;
- recovered directly from the discard pile;
- moved from 2FA back to Password;
- taken for Verification.
3. Verify
If your Password and 2FA are both complete, you may take the required Verification card from:
- another player's Password;
- another player's 2FA;
- the central discard pile.
You may never use cards from your own Password or 2FA for Verification.
Cards in players' hands are never eligible.
For an L5 Goal, both Verification cards must be available and taken during the same turn.
4. Discard
If you have more than 7 cards, discard down to 7.
Authentication
Authentication must always progress in this order:
Password → 2FA → Verification
You may not place cards into 2FA until your Password is complete.
You may not Verify until both Password and 2FA are complete.
Cards do not need to be played in the order shown on the Goal. The required values only need to be present.
Example: a Password requiring 2, 4, 10, K may be completed in any order.
You may freely rearrange cards within your Password or within your 2FA for readability.
Cards may not be moved from Password into 2FA.
If your Password becomes incomplete, you may move a legal card from 2FA back into Password during your Play step. This counts as one of your two card placements.
Stolen Credentials
If another player takes one of your cards for Verification, the affected stage becomes incomplete immediately.
If your Password is broken:
- cards already in 2FA remain there;
- you may not add new cards to 2FA;
- you may not Verify;
- your 2FA cannot score unless Password is repaired before round end.
If a 2FA card is stolen, your Password remains complete but your 2FA becomes incomplete.
Jokers
Jokers are wild in Password and 2FA.
A Joker may satisfy any required position, but it remains a Joker and does not become the actual card it represents.
Verification requires the actual exposed card, so a Joker cannot be used for Verification.
Completing a Goal
When you complete Verification:
- Set the completed Goal card aside.
- Discard all playing cards used for that Goal to the central discard pile.
If you completed an L1 or L2, draw 2 eligible Goal cards, keep 1, and discard the other.
You may not choose a Level you have already completed this round.
If you completed an L3, L4, or L5, the round ends immediately.
Reset Turn
Instead of taking a Normal Turn, you may Reset.
Discard your active Goal and every playing card committed to it. Draw 2 eligible Goal cards, keep 1, and discard the other.
Your turn ends immediately.
You do not Draw, Recover, Play, or Verify on a Reset turn.
End of the Round
When an L3, L4, or L5 Goal is completed, stop play immediately and score each player's current position.
Completed Goals score their full value.
For an unfinished active Goal:
- If Password is incomplete, score 0.
- If Password is complete but 2FA is incomplete, score only the Password value.
- If Password and 2FA are complete, score both values.
- Verification points are scored only for a fully completed Goal.
Collect and shuffle all playing cards and Goal cards before beginning the next round.
Winning
After scoring a round, if nobody has reached 25 points, begin another round.
If one or more players have at least 25 points, the player with the highest score wins.
If tied, the tied player with the most completed Verifications wins.
If still tied, share the victory or play one additional round.
Frequently Asked Questions
What if both the draw pile and discard pile are empty?
Skip Draw/Recover. Play a card if possible. If you cannot, discard 1 card from your hand to create a new discard pile.
Can I partially complete an L5 Verification?
No. Both Verification cards must be taken during the same turn.
Can I play cards after Resetting?
No. Reset uses your entire turn.
What happens to cards from a completed Goal?
They immediately enter the central discard pile and may be used by other players on later turns.
Can I rearrange my played cards?
Yes, within Password or within 2FA. Rearranging does not count as a play.

