Can a player find the answer in the page source?

No, except on a musical lock that asks players to repeat a melody, whose notes are in the page. Typed and tapped answers are stored as bcrypt hashes and compared on the server, and GPS, number and Wordle answers are checked against parameters the page never receives.

Is the hidden content in the page before the lock is solved?

No. The server sends the reveal back only after a right answer. When the creator requires an email address or a name, the reveal also waits until it is given.

Can someone try every code until one works?

Each lock accepts at most 30 answers a minute from one IP address and 120 a minute across all addresses. The creator can also set a maximum number of attempts for the lock.

Does a player need an account?

No. Players open a link or scan a QR code. They do need an internet connection, because the answer is checked on the server.

How answers are checked

On Lock Challenge, the right answer is not in the page a player opens, and neither is what the lock hides. The player's answer goes to our server, the server decides, and only a right answer brings the reveal back. Here is how that works, what it prevents, and where it stops.

From the creator's answer to the reveal, in four steps

The creator sets the answer
In the builder, the creator chooses the code, the word, the pattern or the place that opens the lock, and the content it hides.
The server stores it as a hash
A typed or tapped answer is turned into a bcrypt hash before it is saved. A hash proves that an answer is right without being readable. A GPS position, a number accepted within a margin and a Wordle word cannot be checked against a hash: they stay on the server as parameters and are never sent to the page.
The player sends an answer
The player's page holds the lock, the question and the hint, not the answer. What the player types or taps is sent to the server.
The server compares, then sends the reward
The server compares the answer with the hash or with its own parameters. A wrong answer gets the creator's error message. Only a right answer brings back the hidden content: the text, the link, the picture or the page.

What this prevents

Reading the answer in the page source. The correct answer is not in the HTML or in the scripts the browser receives, so the developer tools give nothing away.
Opening the reveal without solving. The hidden content is put together on the server after a right answer. Before that, it is not in the page.
Trying every code. Each lock accepts at most 30 answers a minute from one IP address, and 120 a minute across all addresses. The creator can also set a maximum number of attempts, cap the number of players or close the lock after its first solve.

Which answer is checked how

Written answers, numeric codes, patterns, arrows, colours, switches and logins are stored as bcrypt hashes and compared on the server. A written answer ignores capitals and accents unless the creator asks otherwise.
A GPS position, a number accepted within a margin and a Wordle word are checked against parameters kept on the server. The page only receives what the player needs to play, such as the distance that counts as close enough or the number of rows on the board.
An access password asked before the game starts is stored as a bcrypt hash as well.
So that the builder can show the creator their own answer again, a second copy is encrypted (AES-256-GCM) with a key held by the server. No player page ever reads it.

What the page does contain, and the one exception

The player page contains what the player is meant to read: the question, the hint, the step titles, and the messages the creator wrote for a wrong answer and for a solve. Those are not the place for the secret.

The one exception is the musical lock that asks players to repeat a melody. Its notes are sent to the browser, because players have to hear them, so on that lock the answer can be read from the page by someone who knows where to look. A musical lock where players name the tune keeps the title as a bcrypt hash, like any written answer.

The honest limits

An answer that is shared stays shared. The server checks the answer, not the person: a player who passes the code on lets others open the lock. Capping players, closing after the first solve, an access password or opening and closing dates limit how far it travels.
Players need a connection. The answer is checked on the server, so a player with no network cannot open the lock. A guest wifi is enough.
The melody to repeat, as above.

What is recorded about players

Players never create an account.
A random identifier is kept in a cookie, so that one player's attempts count as one session.
For each answer: whether it was right, the IP address and the browser's user agent. For each session: the number of attempts and hints, the time taken, the device, the referring page and the language. The creator sees these as statistics.
An email address or a name only when the creator asks for one at the reveal. It goes to that creator alone, and Lock Challenge never sends marketing to it.
Player pages are noindex, so a lock and its title do not appear in search results.

Questions

Can a player find the answer in the page source?: No, except on a musical lock that asks players to repeat a melody, whose notes are in the page. Typed and tapped answers are stored as bcrypt hashes and compared on the server, and GPS, number and Wordle answers are checked against parameters the page never receives.
Is the hidden content in the page before the lock is solved?: No. The server sends the reveal back only after a right answer. When the creator requires an email address or a name, the reveal also waits until it is given.
Can someone try every code until one works?: Each lock accepts at most 30 answers a minute from one IP address and 120 a minute across all addresses. The creator can also set a maximum number of attempts for the lock.
Does a player need an account?: No. Players open a link or scan a QR code. They do need an internet connection, because the answer is checked on the server.