The two players decide in advance how many games they will play, which must be an even number. One player becomes the code maker, the other the code breaker. The code maker chooses a pattern of four code pegs.

Duplicates are allowed, so the player could even choose four code pegs of the same colour. The chosen pattern is placed in the four holes covered by the shield, visible to the code maker but not to the code breaker.

The code breaker tries to guess the pattern, in both order and colour, within ten (sometimes eight or twelve) turns. Each guess is made by placing a row of code pegs on the decoding board. Once placed, the code maker provides feedback by placing from zero to four key pegs in the small holes of the row with the guess.

A coloured (often black) key peg is placed for each code peg from the guess which is correct in both colour and position. A white peg indicates the existence of a correct colour peg placed in the wrong position (to be precise, the number of white pegs is the extra number of black pegs that it is possible to get using exactly the code pegs in that guess.)

Once feedback is provided, another guess is made; guesses and feedback continue to alternate until either the code breaker guesses correctly, or ten incorrect guesses are made.

The code maker gets one point for each guess a code breaker makes. The coloured key pegs are what give you your score, so if you have 5 coloured key pegs on the game board, your score is 5. An extra point is earned by the code maker if the code breaker doesn't guess the pattern exactly in the last guess. The winner is the one who has the most points after the agreed-upon number of games is played.

Originally there were two scoring methods to choose from: code breaker’s score and code maker’s score.
(i) Code breaker’s score: the code breaker gets one point for each row of guesses. The winner is the player with the least number of points after the agreed-upon number of games is played.
(ii) Code maker’s score: The code maker gets one point for each row of pegs not showing the correct code placed by the code breaker. The winner is the player with the most number of points after the agreed-upon number of games is played.

Later this rule was added: If the code breaker can show that the code maker has given wrong information, the game is replayed and the code breaker gets three additional points.