Free phishing quiz for your team
Your colleagues sort ten emails in three minutes: phishing or legitimate? Everyone plays anonymously from a link you share, and you get the result for the whole team.
- Free, no account to create
- 3 minutes each, no names or emails asked
- No fake emails sent: the quiz runs in the browser
- Team result from 5 players
Check your inbox: a confirmation link is on its way to .
- noreply@nophi.sh
- Confirm your team phishing quiz
Check the sender before you click: that is the reflex the quiz trains.
Open it within 48 hours, then confirm: you'll get the link to share with your team. Nothing after a few minutes? Check your spam folder.
How the quiz works
The nophi.sh team phishing quiz is a free online phishing test for employees: each colleague judges ten emails, phishing or legitimate, in about three minutes, without giving a name or an email address, and no fake email is sent. Once 5 people have played, the person who created the quiz sees on a private page the team average, the success rate per type of trap and the most missed trap, with its clues. nophi.sh is a phishing simulation and security awareness SaaS for companies with teams in France and across Europe, hosted in France.
-
Create the quiz
Enter your first name, work email and team size. A confirmation link reaches you right away and stays valid for 48 hours.
-
Share the link
Send the team link over Teams, Slack or email, from your own account. Everyone plays ten emails, with no name and no account. The quiz stays open for 30 days.
-
Read the result
Once 5 people have played, your private link shows the team's result. You get an email at that point, then a recap after 7 days.
What the team result shows
A private page, reached through your personal link. It answers two questions: which traps does your team fall for, and where should you start?
The six types of trap measured
- Fake sign-in page
- Wire fraud / fake executive
- Fake invoice / supplier
- Parcels and deliveries
- Government and taxes
- Legitimate emails taken for phishing
- The number of players
- Nothing detailed appears before 5 players ("3/5" in the meantime), so nobody can be singled out.
- The team average and the spread of scores
- The average score out of 10, and how many people sit at each level.
- Success per type of trap
- The share of players who spotted each type of trap, and the share who recognized the legitimate emails.
- The most missed trap, with its clues
- The email your team got wrong most often, and the signs that gave it away: a good way to open the discussion in a team meeting.
- No individual results
- You never see who played or who got it wrong. Each player sees their own score and what they missed, on their own screen.
A quiz isn't a simulation
The quiz measures what your team can recognize when they know they are being tested. A phishing simulation measures what they do when a fake email lands unannounced, between two meetings. The quiz starts the conversation; the simulation, the next step, gives you the real number.
| Team quiz | nophi.sh simulation | |
|---|---|---|
| What it measures | What people spot when they know it's a test | Reflexes, in real conditions |
| Emails sent | None: the quiz runs in the browser | Realistic fake emails, in real inboxes |
| Result | One anonymous team score | Who opens, clicks or types a password, by department, with training after each mistake |
| Price | Free | 14-day trial, then from €99/month excl. VAT |
Frequently asked questions
Is the quiz really anonymous?
Yes. Players give no name and no email. We store each game's answers, score and duration, linked to the quiz and not to a person. To count one game per person, we use a cookie and a hashed fingerprint of the IP address, never the address itself. That fingerprint is deleted after 30 days.
Who receives the quiz emails?
You receive a confirmation link, then your two links: the team link and your private results link. An email tells you when 5 people have played, and a recap follows after 7 days. These emails are part of the quiz: you get them whether or not you ticked the contact box. Your colleagues receive nothing from us: you pass the link on yourself. Each player sees their own score at the end of their game.
What data do you keep, and for how long?
For you: first name, email, company, team size and your choice for the contact box. We only contact you about the results or our offer if you ticked it, and this data is kept for 3 years after the last contact. For players: the answers and score of each game, with no identity. Games are deleted 13 months after the quiz ends. Our privacy policy has the details.
Why do I need a work email address?
That's where we send your private results link, and it tells us which company the quiz is for. Personal mailboxes (Gmail, Outlook.com, Yahoo, iCloud…) are not accepted.
How much does the quiz cost?
Nothing. It's free, with no account and no credit card, up to 500 games per quiz. To then test your team with fake emails in their real inbox, the nophi.sh trial lasts 14 days, and plans start at €99/month excl. VAT.
How long does a game take?
About 3 minutes: ten emails to judge, phishing or legitimate, with the right answer and its clues after each choice.
The guide: spotting phishing, and what a quiz measures
A phishing quiz, or free phishing test, has people judge real templates of fraudulent and legitimate emails without sending anything to their inbox. It's a good way into security awareness, as long as you know its limits.
How to spot a phishing email: five checks
The signs the quiz trains, in the order to look at them.
Most phishing emails give themselves away through a detail nobody looks at when they are in a hurry. These five checks take a few seconds:
- The sender's real address, not the display name. Anyone can choose a name; the domain gives the imitation away: a zero instead of an o (acme-c0rp.com), an extra word (acmecorp-support.com).
- The link. Hover over it, or long-press on mobile, and read the domain just before the first "/". A sign-in page that is not on the usual domain is a fake page.
- The request. Typing a password, paying, changing bank details, opening an attachment that asks you to enable something: that is where the attack happens.
- The urgency. A deadline of a few hours, a threat of suspension or penalty: the pressure is there to stop you checking.
- The context. Were you expecting this email? When in doubt, check through another channel, with a number you already know, never the one in the message.
Our guide to recognizing fraudulent emails covers each sign with examples, and what to do after a phishing attack covers the steps after a click.
Why start with a quiz
What a phishing test for employees brings before any simulation.
55% of significant attacks in France begin with phishing (CESIN barometer 2026). Before testing your team by surprise, a quiz gives you a first picture without putting trust at risk.
- Nothing to set up. No allowlisting in your mail system, no staff list to import: you share a link.
- Nobody gets caught out. Everyone knows they are playing, and nobody is named. It feels like a game, not an inspection.
- A result that points somewhere. Success per type of trap shows what to work on first: fake sign-in pages, wire fraud or fake invoices.
- A conversation that starts. The most missed trap, shown in a team meeting with its clues, often does more than a slide deck.
What a quiz doesn't measure
Why a good score doesn't guarantee zero clicks.
A quiz is played in the open: you know any email may be a trap, and you take the time to look. In real life, the email arrives between two meetings, on a phone, among fifty others. The gap is real: the KnowBe4 Phishing by Industry Benchmarking Report 2025 measured, across KnowBe4 customers, an average click rate of 33.1% before training, falling to 4.1% after 12 months of simulations and training.
The quiz also doesn't tell you who reports suspicious emails, or whether reflexes hold over time: one game per person is a snapshot, not a follow-up. To measure real behavior and train each person after their mistake, the next step is a phishing simulation.
Three minutes each to see where your team stands
Free, anonymous, and no email sent to your colleagues.