Question: I am currently creating a game where if a player wants to play a certain level, the player has to provide the password to unlock it. I have the following code right now:

```
var password;
var psd= "abcdefg";
password=prompt('Enter the Passcode: ');
if (password==psd){functions}

```

However, I want to make it so that the input text for password is masked. I also want to make it just a tiny bit more secure so that the players won't be able to cheat themselves by inspecting the JavaScript code. Is there a simple way to do this?

Answer: 
The way I would do it is with a an html dialog, containing buttons and a password input element. E.g.:

```
<input type="password" id="pwd">

```

This will give you the black-dots you are referring to.

There is very little you can do to secure the password on the client-side without using a hash function and server-side run-time communication. If you are carrying out the comparison on the client then at some point the password, or the hash, must be present on the client.
One idea to obfuscate your password a little more is to generate user specific passwords, depending on some data that you might have of them, like e-mail address and nickname:

```
var email = "xyz@abc.com";
var player = "zoidberg";

function createHash(text) {
    //a function that returns a unique hash, i.e. MD5 or others (depending on your needs of security)
}

//this is the password that you show the user when he finished a level
var pw = createHash(email + player).substring(0, 8);

//this is the internal hashed passwork
var hashedPw = createHash(pw);

//a function that validates a password that was entered by the user
function validate(userInput) {
    if (createHash(userInput) === hashedPw) {
        return true;
    }
    return false;
}

```

Of course, if someone looks at your javascript code, he can still figure out the entire logic behind the password creation but at least you don't have your password written down in clear letters. And as an additional plus, different players can't just share their password because each player has an individual one.

That being said, the safest way is of course to move the whole authentification process to the serverside. Safe your passwords somewhere in your database and make AJAX calls to verify a password that was entered by the user.