Reverse-engineering an online ADHD test reveals what it actually tracks

Prompted by a lifelong pattern of picking up hobbies and dropping them, the author got evaluated for ADHD and was sent to an online assessment — a bare-bones, Flash-game-style continuous performance test. The task: hit Space whenever a card showing three red hearts appears, and ignore everything else. As the test wore on it piled on distractions, layering in clip art and audio of crying babies and police sirens. Curious, the author opened DevTools mid-exam, saved all the page scripts, and captured the outbound requests to see how the thing worked.

The client-side code turned out to be straightforward instrumentation. It logged the timing of every spacebar press, flagged every ‘bad’ press (any non-Space, non-Enter key), and used focus/blur handlers to detect when the test window lost focus — so switching tabs is recorded and penalized. The assets even branched on age group: children got a 15 FPS render with sounds like birds and lightsabers, while adults got 24 FPS with babies crying, car crashes, and sirens. Notably, the payload sent back to the server contained only three things: press timings, bad-press timings, and total time out of focus.

The scoring itself lives server-side and isn’t exposed in the source. Per the vendor’s own site, those raw timing signals feed standardized, age- and gender-normed Z-scores across four metrics — Attentiveness, Timeliness, Hyper-Reactivity, and Impulsiveness. The takeaway is a tidy illustration of how a clinical-feeling diagnostic reduces, at the wire level, to reaction-time and attention telemetry, with the interpretive model kept off the client.