diff --git a/internal/game/session.go b/internal/game/session.go
index 0f9c5ba..f9a0919 100644
--- a/internal/game/session.go
+++ b/internal/game/session.go
@@ -29,14 +29,15 @@ type Session struct {
 
 func NewSession(phrase string) Session {
 	sessionName := petname.Generate(3, "-")
+	p := strings.Split(phrase, "")
 
 	s := Session{
 		id:               lastSessionId,
 		Name:             sessionName,
 		Users:            []User{},
-		phrase:           []string{phrase},
+		phrase:           p,
 		AskedLetters:     []string{},
-		DiscoveredPhrase: make([]string, len(phrase)),
+		DiscoveredPhrase: make([]string, len(p)),
 		Mistakes:         0,
 		userIndex:        0,
 		CurrentUser:      nil,
diff --git a/internal/rest_handler/guess_letter.go b/internal/rest_handler/guess_letter.go
new file mode 100644
index 0000000..76d8887
--- /dev/null
+++ b/internal/rest_handler/guess_letter.go
@@ -0,0 +1,47 @@
+package rest_handler
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+
+	"gitea.elara.ws/Hazel/hangman/internal/game"
+	"github.com/labstack/echo/v4"
+)
+
+func GuessLetter(c echo.Context) error {
+	session := game.GetSession(c.Param("session"))
+
+	sig := c.Request().Header.Get("signature")
+	body, _ := io.ReadAll(c.Request().Body)
+
+	u := session.VerifySignature(sig, body)
+	if u == nil {
+		return c.String(http.StatusBadRequest, "This user was not fount in the current session.")
+	}
+
+	if !session.CurrentUser.PublicKey.Equal(u.PublicKey) {
+		return c.String(http.StatusBadRequest, "It's not the turn of user "+u.Name+". It's the turn of "+session.CurrentUser.Name+".")
+	}
+
+	c.Request().Body = io.NopCloser(bytes.NewBuffer(body))
+
+	type BodyContent struct {
+		Guess string
+	}
+	var bodyContent BodyContent
+
+	err := c.Bind(&bodyContent)
+	if err != nil {
+		fmt.Println(err)
+		return c.String(http.StatusBadRequest, err.Error())
+	}
+
+	_, err = session.GuessLetter(bodyContent.Guess)
+	if err != nil {
+		return c.String(http.StatusBadRequest, err.Error())
+	}
+
+	return c.JSON(http.StatusOK, session)
+}
diff --git a/main.go b/main.go
index 6960581..d4b18a8 100644
--- a/main.go
+++ b/main.go
@@ -8,7 +8,6 @@ import (
 
 	"gitea.elara.ws/Hazel/hangman/internal/rest_handler"
 	"gitea.elara.ws/Hazel/hangman/internal/view_handler"
-	"gitea.elara.ws/Hazel/hangman/internal/words"
 	"github.com/labstack/echo/v4"
 )
 
@@ -27,9 +26,6 @@ func (t *TemplateRegistry) Render(w io.Writer, name string, data interface{}, c
 }
 
 func main() {
-	fmt.Println(words.GetRandomWord())
-	return
-
 	fmt.Println("wanna play hangman? Well ya cant since it isn't implemented yet..")
 
 	e := echo.New()
@@ -44,6 +40,7 @@ func main() {
 	e.POST("/api/session", rest_handler.CreateSession)
 	e.POST("/api/:session/user", rest_handler.CreateUser)
 	e.POST("/api/:session/test-auth", rest_handler.TestAuth)
+	e.POST("/api/:session/guess", rest_handler.GuessLetter)
 
 	e.GET("/", view_handler.CreateSession)
 	e.GET("/:name", view_handler.CreateUser)
diff --git a/python_frontend/frontend.py b/python_frontend/frontend.py
index e56fce9..5dc32b5 100644
--- a/python_frontend/frontend.py
+++ b/python_frontend/frontend.py
@@ -35,6 +35,12 @@ class User:
             "foo": "bar"
         })
         print(r.content)
+
+    def guess(self, letter: str):
+        r = self.signed_request("/guess", {
+            "Guess": letter
+        })
+        print(r.content)
     
     def signed_request(self, endpoint: str, body: dict) -> requests.Response:
         payload = json.dumps(body).encode("utf-8")
@@ -89,13 +95,18 @@ var Words []string = []string{"""
     
 
 if __name__ == "__main__":
-
-    build_word_dict()
-
     s = Session()
     print(s)
-    s.add_user(name="Hazel")
-    u = s.add_user(name="OtherHazel")
-    print(u)
+    a = s.add_user(name="Hazel")
+    b = s.add_user(name="OtherHazel")
+    
+    print(b)
+    b.test_auth()
 
-    u.test_auth()
+    b.guess("e")
+    a.guess("e")
+    b.guess("e")
+    b.guess("a")
+    a.guess("i")
+    b.guess("o")
+    a.guess("u")