Patient reverse engineers his own online ADHD test
The author, prompted by a friend's recent autism diagnosis, got evaluated for ADHD. His psychiatrist warned him that once the online test began she would not be able to talk to him, then sent a "Begin Test" link. The test itself was a simple, dated looking browser game: press the spacebar whenever a card showing three red hearts appeared, and do nothing otherwise. Other clip art, then crying babies and police sirens, were layered in as distractions while the task dragged on with no visible timer or score, until near the end he started mashing the spacebar out of sheer frustration hoping it would finish.
Before starting, he had opened DevTools and saved the page's scripts and outbound requests to inspect later. Reading the saved code, he found a keyup handler logging every correct spacebar press with a timestamp into one array, and every other keypress (any key but space or enter) into a separate "bad click" array. A focus/blur hook detected whenever the browser tab lost focus, for instance by switching tabs, played an alert beep, showed an on-screen warning, and accumulated the total time spent out of focus. The code also branched on an ageGroup variable: children's assets ran at 15 FPS with sounds like birds, bowling pins and lightsabers, while the adult version ran at 24 FPS with sounds including crying babies, car brakes and police sirens.
According to his reading of the code, the payload actually sent back to the server contained only three things: the timestamps of correct spacebar presses, the timestamps of incorrect keypresses, and the total time the window had spent unfocused. He could not find any scoring formula in the client code. Checking the test provider's own public page instead, he found that it describes reporting standardized, age and gender normed Z-scores across four metrics: Attentiveness, Timeliness, Hyper-Reactivity and Impulsiveness, each defined on the page in terms of everyday difficulties (missing details, reacting late under time pressure, acting on impulse, or excessive fidgeting and talking).
After the first sitting, his psychiatrist asked whether he had tried to cheat, telling him his results were so far outside the normal range that she suspected tampering, possibly triggered by the DevTools/focus-detection code he had poked at. He denied trying to cheat and she scheduled a retake, which he approached by trying to stay genuinely focused rather than spamming the key. Before the retake he found one more function in the saved code, one that posts a test ID and a clinic email address to an API endpoint, apparently the mechanism the results use to reach the clinician's side. The article ends there: it does not name the test, its vendor or the clinic, and it never states what score or diagnosis either sitting produced.
Key facts
- The author, evaluated for ADHD after a friend's autism diagnosis, saved his online assessment's JavaScript and network traffic via browser DevTools while taking the test his psychiatrist assigned.
- The client code logs every correct spacebar press on cards with three red hearts separately from every other keypress, and tracks total time the browser tab spent out of focus, sounding an alert if it loses focus.
- The test swaps assets by age group: children's version runs at 15 FPS with sounds like birds and lightsabers, adults' at 24 FPS with sounds like crying babies, car brakes and police sirens.
- The captured network payload held only keypress timestamps and out-of-focus time; no scoring formula appeared in the code, but the vendor's public page says results come back as age and gender normed Z-scores on four metrics: Attentiveness, Timeliness, Hyper-Reactivity and Impulsiveness.
- After the first sitting his psychiatrist said the results were so far outside normal she suspected cheating; she let him retake the test once he denied it.
Why it matters
The piece is a rare look inside a proprietary clinical assessment tool from the patient's side. It shows a widely used category of software, the continuous performance test used in ADHD workups, quietly logging behavioral telemetry (keystroke timing, tab-focus loss, an audible cheat alert) well beyond what a patient is told about, while the actual scoring logic never touches the browser at all: it lives entirely on the server, out of reach of casual inspection.
Who it affects
Anyone taking a web-based psychological or behavioral assessment, since the same pattern (client-side logging, server-side black-box scoring) is common to that category of tool. It also touches clinicians who rely on a vendor's scoring without visibility into how it works, and the vendor itself, whose test and identity the author declined to name.
How to use it
The practical takeaway is for patients and the technically curious: opening DevTools before a browser-based assessment, as the author did, will show what is actually being measured (here, keypress timing and focus loss) even when the scoring itself is opaque. It is not a tool or product with pricing to adopt, just a demonstration of what inspecting a page's own scripts can reveal.
How solid is it
The account is first-person and self-reported, built on the author's own reading of JavaScript he saved from the live test plus a quote from the test vendor's own public marketing page describing its four scored metrics. Neither the vendor, the test, nor the clinic is named or independently confirmed, and the author's interpretation of the code (including whether a DevTools trap exists) is his own, not verified against vendor documentation.
Risks and caveats
The article does not disclose a final score or diagnosis for either sitting, and it does not show the algorithm that turns the logged keypress and focus data into the four Z-scores, so the mechanics of the diagnosis itself remain unconfirmed. Whether the test contains a deliberate cheat-detection trap is the author's speculation, not a demonstrated fact. Separately, inspecting or modifying a clinical instrument's code while taking it, as the author did, risks being read by a clinician as tampering, which is exactly the accusation he faced.
“Standardized Z-scores are offered for four different attention metrics: Attentiveness, Timeliness, Hyper-Reactivity and Impulsiveness. Scores are standardized based on an age and gender-matched norm group.”
— the test provider's public page