diff --git a/app/__pycache__/app.cpython-313.pyc b/app/__pycache__/app.cpython-313.pyc
new file mode 100644
index 0000000..d4c8bb2
Binary files /dev/null and b/app/__pycache__/app.cpython-313.pyc differ
diff --git a/app/app.py b/app/app.py
index f8393bf..841f938 100644
--- a/app/app.py
+++ b/app/app.py
@@ -1,38 +1,102 @@
 import os
 import sqlite3
-from flask import Flask, request
+import time
+from flask import Flask, redirect, request, session
 
 app = Flask(__name__)
+app.secret_key = "escape-room-secret"
 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
 DB_PATH = os.path.join(BASE_DIR, "adventure.db")
 
+
 def get_db():
     db = sqlite3.connect(DB_PATH)
     db.row_factory = sqlite3.Row
     return db
 
+
+def get_highscores(limit=10):
+    db = get_db()
+    rows = db.execute(
+        """
+        SELECT name, fertig_zeit - start_zeit AS dauer
+        FROM spieler
+        WHERE fertig_zeit IS NOT NULL
+        ORDER BY dauer
+        LIMIT ?
+        """,
+        (limit,),
+    ).fetchall()
+    db.close()
+    return rows
+
+
 @app.route("/", methods=["GET", "POST"])
 @app.route("/app", methods=["GET", "POST"])
 @app.route("/app/", methods=["GET", "POST"])
 def start():
+    if request.method == "POST" and "spielername" in request.form:
+        name = request.form.get("spielername", "").strip() or "Unbekannt"
+        db = get_db()
+        cur = db.execute(
+            "INSERT INTO spieler (name, start_zeit, fertig_zeit) VALUES (?, ?, NULL)",
+            (name, time.time()),
+        )
+        db.commit()
+        db.close()
+        session["player_id"] = cur.lastrowid
+        session["player_name"] = name
+        return redirect("/app/?room=1")
+
     room_id = request.args.get("room", type=int)
-    if room_id is None:
-        return '<h1>Verlies</h1><a href="/app/?room=1">Abenteuer starten</a>'
+    player_id = session.get("player_id")
+
+    if room_id is None or player_id is None:
+        html = "<h1>Verlies</h1>"
+        if player_id is not None:
+            html += "<p>Willkommen zurück, " + session.get("player_name", "Spieler") + ".</p>"
+        else:
+            html += "<p>Bitte gib zuerst deinen Namen ein, bevor du ins Verlies gehst.</p>"
+        html += "<form method='post'><label>Dein Name</label><input name='spielername'><button>Starten</button></form>"
+        html += "<p><a href='/app/highscore'>Highscores ansehen</a></p>"
+        html += "<h2>Highscores</h2><ol>"
+        rows = get_highscores()
+        if rows:
+            for row in rows:
+                html += "<li>" + row["name"] + ": " + f"{row['dauer']:.2f}" + "s</li>"
+        else:
+            html += "<li>Noch keine abgeschlossenen Spiele.</li>"
+        html += "</ol>"
+        return html
 
     db = get_db()
-    r = db.execute("SELECT name, beschreibung, raetsel_frage, raetsel_antwort FROM raeume WHERE id = ?", (room_id,)).fetchone()
+    r = db.execute(
+        "SELECT name, beschreibung, raetsel_frage, raetsel_antwort FROM raeume WHERE id = ?",
+        (room_id,),
+    ).fetchone()
     ausgaenge = db.execute(
         "SELECT richtung, nach_raum FROM ausgaenge WHERE von_raum = ?", (room_id,)
     ).fetchall()
     db.close()
 
     if r is None:
-        return '<h1>Raum nicht gefunden</h1>'
+        return "<h1>Raum nicht gefunden</h1>"
 
     if r["raetsel_frage"]:
         if request.method == "POST":
             if request.form.get("antwort", "").strip() == r["raetsel_antwort"]:
-                return "<h1>Befreit!</h1>"
+                db = get_db()
+                current = db.execute(
+                    "SELECT fertig_zeit FROM spieler WHERE id = ?", (player_id,)
+                ).fetchone()
+                if current and current["fertig_zeit"] is None:
+                    db.execute(
+                        "UPDATE spieler SET fertig_zeit = ? WHERE id = ?",
+                        (time.time(), player_id),
+                    )
+                    db.commit()
+                db.close()
+                return "<h1>Geschafft!</h1><p>Du hast den Schatz gefunden.</p><p><a href='/app/highscore'>Zum Highscore</a></p>"
             return 'Leider falsch. <a href="/app/?room=' + str(room_id) + '">nochmal</a>'
 
         html = "<h1>" + r["name"] + "</h1>"
@@ -46,6 +110,20 @@ def start():
         html += '<a href="/app/?room=' + str(a["nach_raum"]) + '">' + a["richtung"] + '</a> &nbsp; '
     return html
 
+
+@app.route("/app/highscore")
+def highscore():
+    html = "<h1>Highscores</h1><ol>"
+    rows = get_highscores()
+    if rows:
+        for row in rows:
+            html += "<li>" + row["name"] + ": " + f"{row['dauer']:.2f}" + "s</li>"
+    else:
+        html += "<li>Noch keine abgeschlossenen Spiele.</li>"
+    html += "</ol><p><a href='/app/'>Zurück zum Spiel</a></p>"
+    return html
+
+
 if __name__ == "__main__":
     port = int(os.environ.get("PORT", "9003"))
     app.run(host="0.0.0.0", port=port)
diff --git a/app/init_db.py b/app/init_db.py
index 8530b66..7bd1dc1 100644
--- a/app/init_db.py
+++ b/app/init_db.py
@@ -5,6 +5,7 @@ db = sqlite3.connect("adventure.db")   # Datei wird angelegt, falls nicht da
 db.executescript("""
 DROP TABLE IF EXISTS raeume;
 DROP TABLE IF EXISTS ausgaenge;
+DROP TABLE IF EXISTS spieler;
 
 CREATE TABLE raeume (
     id INTEGER PRIMARY KEY,
@@ -18,6 +19,12 @@ CREATE TABLE ausgaenge (
     richtung TEXT,
     nach_raum INTEGER
 );
+CREATE TABLE spieler (
+    id INTEGER PRIMARY KEY,
+    name TEXT,
+    start_zeit REAL,
+    fertig_zeit REAL
+);
 
 INSERT INTO raeume (id, name, beschreibung, raetsel_frage, raetsel_antwort) VALUES
     (1, 'Eingangshalle', 'Eine schwere Tür fällt hinter dir zu. Zwei Gänge führen ins Dunkel.', NULL, NULL),