Puzzle lock

Type the secret: a geocache's final coordinates, the next clue in an escape room, or the code for a box. Type the answer that should open it, add a title and a hint if you like, and press Make the lock. You get a link. Put it on your cache listing, a worksheet or a slide.

Whoever opens the link sees the title and hint and a box for their answer. The right answer shows the secret, and coordinates come with links to open them in a map app. A wrong one just says so, as many times as it takes.

The answer is never stored. Instead, it's turned into an encryption key, and the secret is locked with that key using AES-GCM, a standard cipher built into every modern browser. The link carries only the locked secret. Typing an answer turns it into a key the same way; the right answer makes the right key and the secret opens, and any other answer makes a key that doesn't fit.

Turning an answer into a key takes 250,000 rounds of SHA-256 (PBKDF2), with a random salt for every lock. That makes each guess take a noticeable fraction of a second, and stops anyone using a list of pre-computed guesses. Everything happens in the browser, and the lock sits after the # in the link, a part browsers never send to a server, so the secret and the answers people try go nowhere.

It's a padlock for a puzzle, not a safe. There's no server to stop someone trying answers as fast as their computer allows, so a short answer can be found by trying them all: a four-digit code has only 10,000 possibilities. Use a word or a phrase, or a longer number, and it's fine for a cache final or a classroom lock. Don't use it for anything that matters if it's opened.

Capitals, spaces and punctuation don't count unless you tick Match the answer exactly, so "The Rosetta Stone" and "rosetta stone" are different, but "Rosetta-Stone!" and "rosettastone" are the same. A typo in an answer can't be fixed afterwards: make a new lock.

If you list a geocache, check your listing service's guidelines on puzzle checkers before you add a link.