An honest answer: much safer than a code hidden in a page, and still not a vault. Here is exactly what protects it, and what does not.
- The answer
- Never in the page. A written answer or a code is stored as a bcrypt hash and checked on our server.
- The code
- Sent to the phone only after a correct answer. Before that, it is not in the page, its source or anything the page downloads.
- Guessing
- Attempts are rate limited per IP and per lock, which slows down anyone trying answers by brute force. It does not stop someone who knows you from guessing a weak answer: pick one only they would know.
- Search engines
- Player pages are noindex: the lock does not show up in search results.
- The hint
- The hint is in the page before anyone solves it. Never put the code, or any part of it, in the hint.
- The melody lock
- Do not use the melody lock for a valuable code: a melody to repeat has to play in the browser, so its notes can be read. Use a written answer, a number or a pattern.
- Who sees it
- Anyone who has the link and solves the riddle sees the code. Send the link to the recipient only.
- Knowing it was opened
- Unlock alerts, by email or Telegram, on every plan, tell you when it is opened (one switch per lock, off by default). Pro adds an access code, single use and a cap on players.
- Retailer terms
- Some gift cards cannot be resold or transferred. Check the card's own terms.