Question: I am currently creating a game where if a player wants to play a certain level, the player has to provide the password to unlock it. I have the following code right now:

```
var password;
var psd= "abcdefg";
password=prompt('Enter the Passcode: ');
if (password==psd){functions}

```

However, I want to make it so that the input text for password is masked. I also want to make it just a tiny bit more secure so that the players won't be able to cheat themselves by inspecting the JavaScript code. Is there a simple way to do this?

Answer: 
for the security bit, you could hash the correct password an then create the hast of the input and check if those are equal (for example md5 or sha1) (as posted in the answer before md5 (and i think sha1 too) are not "secure" but i doubt anyone would put so much effort in unlocking this level
One idea to obfuscate your password a little more is to generate user specific passwords, depending on some data that you might have of them, like e-mail address and nickname:

```
var email = "xyz@abc.com";
var player = "zoidberg";

function createHash(text) {
    //a function that returns a unique hash, i.e. MD5 or others (depending on your needs of security)
}

//this is the password that you show the user when he finished a level
var pw = createHash(email + player).substring(0, 8);

//this is the internal hashed passwork
var hashedPw = createHash(pw);

//a function that validates a password that was entered by the user
function validate(userInput) {
    if (createHash(userInput) === hashedPw) {
        return true;
    }
    return false;
}

```

Of course, if someone looks at your javascript code, he can still figure out the entire logic behind the password creation but at least you don't have your password written down in clear letters. And as an additional plus, different players can't just share their password because each player has an individual one.

That being said, the safest way is of course to move the whole authentification process to the serverside. Safe your passwords somewhere in your database and make AJAX calls to verify a password that was entered by the user.