PolyTrack Unblocked: Where to Play Safely and What to Avoid

PolyTrack at the start of a track. The Record / Current / Difference timer is the whole game. Screenshot: PolyTrack by Kodub.

Somebody built a TrackMania-grade physics racer, put it in a browser tab, and gave it away. That’s PolyTrack. One developer, no ads, no account, no install.

Then the internet did what the internet does. Within months, hundreds of copies appeared on domains school firewalls hadn’t gotten around to blocking yet, and “PolyTrack unblocked” turned into one of the most-searched gaming phrases on school Chromebooks.

I’ve spent a lot of time looking at the sites that host these mirrors. Most are harmless. Some aren’t. Below is what the game actually is, how the unblocked ecosystem really works, and the part almost nobody writes about — what you’re handing over when you load a racing game from a domain you’ve never heard of.

What PolyTrack Actually Is

PolyTrack is a free, browser-based, low-poly time-trial racer built by Kodub, a solo indie developer. It first showed up on Kodub’s Itch.io page in early 2023 and hasn’t stopped getting updates since.

The comparison everyone reaches for is TrackMania, and it’s fair. Same obsession with the millisecond. Same loops, ramps, and impossible jumps. Same feeling that you were this close before you clipped a rail and lost half a second you’ll never get back.

Two things make it stick, though.

The first is the physics. They’re tight and genuinely unforgiving. A slightly late brake doesn’t cost you a tenth — it costs you the run. The second is that you’re not just a driver. There’s a built-in track editor, and the community actually uses it.

The tech behind it

What impresses me most is the toolchain. Kodub builds this with Three.js for rendering, Blender for models, Bullet for physics, GIMP and Inkscape for graphics, and Audacity for audio. That’s a lean, almost entirely open-source stack for a game that runs at a smooth framerate on a $200 school laptop.

Version 0.2.0 landed on 21 March 2023, the first real public milestone. The current build is v0.6.2.

Where you can officially play it

Both the developer’s hub and the playable build sit at the official PolyTrack page at kodub.com. You may still see older guides pointing at an app-polytrack.kodub.com subdomain — that address no longer resolves, so ignore it.

Start here if you possibly can. Everything below this line is a workaround, and workarounds have costs.

So What Does “Unblocked” Even Mean?

Here’s the thing people get wrong: PolyTrack Unblocked isn’t a different game. There’s no special edition, no cracked build, no secret version with extra tracks.

It’s the same game. Different address.

School and corporate networks filter traffic by domain and by category. A filter sees itch.io, tags it “Games,” and drops the connection. But that filter is only as good as its category list — and the internet mints new domains faster than any vendor can classify them.

So the game gets rehosted somewhere the filter hasn’t labeled yet. That’s the entire trick.

Think of it like a school banning one specific corner shop. The shop opens under a new name across the street. Same sweets, same shelves, new sign. Eventually the school notices and bans that one too.

The four flavours of mirror

Third-party game portals. Sites that embed the game in an iframe alongside fifty others. They live on rotating domains and survive on ad revenue.

GitHub Pages. Static, self-contained deployments. Because github.io is a developer domain, filters rarely touch it. This GitHub Pages deployment of PolyTrack 0.4.1 is a good example of the pattern — an older build, frozen in time, served as static files with no ads wrapped around it.

Google Sites. The most effective of the lot, and it’s not close. Almost every school whitelists sites.google.com because Google Classroom depends on it. Blocking it breaks the school day. This Google Sites page hosting Poly Track 0.6.0 shows exactly why the approach works: the domain is load-bearing infrastructure, so it stays open.

Chrome extensions. Packaged builds that run in a popup, sometimes offline. Convenient. Also the riskiest category by a wide margin, and I’ll come back to why.

See It in Motion

Reading about the handling model tells you nothing. Watch a clean run instead — the braking points, the way speed carries through a loop, how little margin there is on the landings.

How It Plays

There’s no grid of rivals. No rubber-banding AI. You race three opponents, and all of them are versions of you:

• Your personal best
• A ghost replay of your last clean run
• Den global leaderboard

That’s a deliberate design choice, and it’s why the game has legs. You’re never blaming a bad opponent. The clock doesn’t negotiate.

Controls

Learn Ange early. Most new players hammer R and replay the same opening corner four hundred times, when the section costing them the run is halfway down the track.

Tracks

You get 15 official tracks from Kodub, plus 22-odd community tracks bundled in. They ramp from gentle to genuinely brutal, and they lean on high-speed loops, long jumps, hairpins, precision ramps, boost pads, and checkpoints.

Then the editor opens up, and the ceiling disappears entirely.

The Part the Mirror Sites Skip

Now the honest bit. I write about security, and I’d be doing you a disservice if I stopped at “here’s how to play it in study hall.”

An unblocked mirror is a stranger serving you code. Sometimes that’s fine. Sometimes it isn’t.

What actually goes wrong

Malicious ad networks. The low-tier game portals monetise with whatever ad broker pays most, and those brokers are where malvertising lives. You don’t need to click anything. A hostile creative loads in an iframe and starts probing your browser.

Trojanised builds. A static HTML5 game is trivial to modify. Someone forks it, injects a script, and rehosts. The car still drives. Something else runs alongside it. This pattern is old and it works — we’ve documented how classic games are being used in malware campaigns, and browser racers are no different in principle.

Chrome extensions. This is the one that should worry you. An extension asking to “read and change all your data on all websites” can read your email, your logins, and your session cookies. A racing game does not need that permission. Ever. If the install prompt asks for it, close the tab.

Fake mirrors and lookalikes. Search “polytrack unblocked” and you’ll find domains that exist purely to farm clicks toward downloads, surveys, and installers. The same instincts apply here as anywhere else you’re weighing an unfamiliar site — the questions we walk through when asking whether a streaming site like 9animetv is actually safe transfer cleanly to game mirrors. And if a “free skins” or “unlock all tracks” offer appears, understand that scammers exploit trust in games precisely because players are mid-flow and not thinking about threat models.

A framework I’d actually use

1. Try the official URL first. Plenty of filters never blocked kodub.com. People assume they did and skip straight to a mirror. Check.
2. Prefer static hosts. A GitHub Pages or Google Sites deployment serving static files has a far smaller attack surface than an ad-funded portal.
3. Never install an extension for a browser game. The game runs in a tab. That’s the whole point.
4. Watch the permissions and the pop-ups. Downloads, surveys, notification prompts, “your Chrome is out of date” — leave.
5. Don’t reuse a real password. No mirror should ever ask for one. If one does, you’ve answered the question.

And the rule nobody wants to hear

Bypassing your school or employer’s network filter usually breaks their acceptable-use policy. Not the law — the policy. But that policy is often what stands between you and a suspended account, a confiscated Chromebook, or an awkward conversation with IT.

Your device may also be managed. On a school-issued Chromebook, an administrator can see the domains you visit whether or not the filter blocked them. The mirror gets you past the block. It doesn’t make you invisible.

One size doesn’t fit here. A university’s open Wi-Fi is not a locked-down district Chromebook, and pretending they carry the same risk would be dishonest.

Quick Answers

Is PolyTrack free? Completely. Browser, Windows, macOS, Linux, Android. No purchase, no account.

Is PolyTrack Unblocked a different game? No. Same game, different domain.

Will it run on a school Chromebook? Yes. It’s HTML5 — no plugins, no install.

Do I need a VPN? No, and on a managed device a VPN often trips more alarms than the game ever would.

Are the mirrors safe? Some are. Some aren’t. The static ones are usually fine; the ad-heavy portals and the browser extensions are where the trouble starts.

Can I build my own tracks? Yes, that’s the best part. The editor ships with the game, and community tracks are how most players eventually spend their time.

Where That Leaves You

PolyTrack earned its audience honestly. One developer, an open-source toolchain, a physics model with real depth, and an editor that hands the game back to the people playing it. The unblocked ecosystem grew around it because the game is good and because school firewalls are blunt instruments.

Play it. Just be deliberate about where you load it from.

Official build first. Static mirror second. Browser extension never.