Zsh + coreutils, 213 bytes

n=$(shuf -n1 -i0-9999999);out=$( (eval "$(tr -dc 'tn -/:-@[-`{-~')") );s=$((n**.5));i=1;p=Yes;while [[ "$i" -le "$s" ]];do;i=$((i+1));if [[ $((n%i)) -eq 0 ]];then;p=No;break;fi;done;[[ "$p" = "$out" ]]&&echo Win

Must be run as root on a typical modern Linux system. (so no TIO link). Telling you why would spoil the challenge.

Flag is Win with a trailing newline, printed to stdout.

R, 66 bytes, Cracked by Dominic van Essen

function(x) with(x, is.finite(a) && is.finite(b) && is.nan(a + b))

Try it online!

This is a slight (but significant) modification of my previous post. The flag is TRUE. That is, find x such that f(x) is TRUE.

Intended solution

R, 67 bytes, cracked by pppery

function(x) with(x, is.finite(a) && !is.finite(b) && is.nan(a + b))

Try it online!

The flag is TRUE. That is, find x such that f(x) is TRUE.

R, 143 bytes, cracked by Giuseppe

function(x, y, z){
  if(length(ls(1)) > 1 | length(ls()) != 3) return("S")
  LETTERS[lengths(lapply(y, intToUtf8(x), z)) * lengths(lapply(y, intToUtf8(x+32), z))]
}

Try it online!

Once again, the value to output is the string "R". The line with length(ls()) is there to try to close some loopholes; in any case, you need to find objects x, y and z such that f(x, y, z) == "R" is TRUE.

Giuseppe found a nice solution using the functions ^ and ~. The solution I had in mind was f(67, list(as.factor(1:3)), 4:6): Try it online! (any vectors of length 3 would work). The trick is that the functions c and C both exist (with the second being much less known). Calling c(1:3, 4:6) returns the length 6 integer vector 1 2 3 4 5 6; calling C(as.factor(1:3), 4:6) returns a length 3 factor 1 2 3 (with contrasts 4 5 6). The product of the lengths is thus 18, which is the position of R in the alphabet.

JavaScript, 2465 bytes, cracked by the default.

X=([...O],S=[])=>{let M,F,a,b,R,n;M=F=0;while(O.length)eval(("?S.shift())#[a,b]!2);F=a==b;?a-b)#M++#?M)#%#M=0#M=%#R=%O=[]#n=%n!n);if(F)O=n.concat(O)".split`#`[O.shift()]||"").replace(/%/g,"S.pop();").replace(/?/g,"S.push(").replace(/!/g,"=S.splice(-"));return R};const U=prompt().split``.map(e => e.charCodeAt()).join``.replace(/9/g,"").split("").map(e=>+e);R={s:20,m:0x80000000,a:1103515245,c:12345,get q(){return R.s=(R.a*R.s*+R.c)%R.m},i(v){return R.q/~-R.m*v|0},get b(){return R.i(2)},h([...a]){for(i=~-a.length;i>0;i--){j=R.i(i+1);[a[i],a[j]]=[a[j],a[i]]}return a}};R.s=U.reduce((p,c)=>p+c,0);class S{constructor(w,n=0){this.w=w;this.n=n;this.s={};this.c={}}N(T=this){return new S(T.w,T.n)}P(T=this){for(let i=0;i<T.w;i++)if(!T.c[i])T.A(i,T.n++);return T}M(s,t,T=this){let A=T.c[s],B=T.c[t];T.s[A]=T.s[A]||[];T.s[B]=T.s[B]||[];T.s[A].push(...T.s[B]);T.s[B].map(c=>{T.c[c]=A});delete T.s[B]}S(a,b,T=this){return T.c[a]==T.c[b]}A(c,s,T=this){T.c[c]=s+="";T.s[s]=T.s[s]||[];T.s[s].push(c)}*[Symbol.iterator](){yield*Object.entries(this.s)}Z(f=false,T=this){let C,b,c,v,N,r,g,l,m;C=[];b=[c=0];for(;c<~-T.w;c++){if(T.S(c,c+1)||(!f&&R.b)){C.push(b);b=[c+1]}else{T.M(c,c+1);b.push(c+1)}}C.push(b);v=[];N=T.N();if(!f){for(let[i,s]of T){let q=R.i(s.length-1);if(!q)q++;g=R.h(s).slice(0,q);v.push(...g);g.map(c=>N.A(c,i))}}r=[];C.map(c=>c.map((e,i,a)=>{l=i+1==a.length;m=!l*2;m|=1*(v.indexOf(e)!==-1);r.push(m)}));return[N.P(),r]}static F(w=10,h=10){let s=new S(w).P(),r,g=[[1]],i=0;for(;i<w;i++)g[0].push(1,1);for(let i=0;i<h;i++){[s,r]=s.Z(i===h-1);g.push(...I(r))}return g}};let I=(r, last=false)=>{let D=[1],E=[1];r.map(c=>{D.push(0,+((c&2)==0));E.push(+((c&1)==0),1)});return[D,E]};class B{constructor(w=10,h=10){this.m=S.F(w,h);this.r=0;this.G=true;this.f()}a(x=this.x,y=this.y){return this.m[y][x]}f(T=this){T.x=T.y=T.ey=1;while(T.a()!=0)T.x++;T.ex=this.m[0].length-1;while(T.a(T.ex)!=0)T.ex--}W(){return this.x==this.ex&&this.y==this.ey}d(r=this.r){return [[0,1],[-1,0],[0,-1],[1,0]][r]}L(){this.r++;this.r%=4}F(){let o=this.x,p=this.y,d=this.d();this.x+=d[0];this.y+=d[1];if(this.a()==1){this.x=o;this.y=p;this.G=false}if(this.W()){console.log("win");this.G=false}}M(r){r=this.r+r;r%=4;let m=-1,d=this.d(r),x=this.x,y=this.y;while(this.a(x,y)!=1){x+=d[0];y+=d[1];m++}return m}T(f){let ms=[1,3,0,2],v=f(ms.map(e=>this.M(e)));while(v&&this.G){this["KLFK"[v%4]].bind(this)();v>>=2}return this.G}R(f){let Y=999;while(this.G&&Y-->0)this.T(f)}}(new B()).R(a=>X(U,a))

Try it online! The flag is win. There should be no other output produced by the program. Although I designed this program to work with Firefox's implementation of JavaScript, it also works on node, hence the link. Input is a string through prompt, which is substituted for a command line argument in the header of the node TIO link.

There is very much method in this madness; brute force is neither recommended nor viable, hopefully. Slightly golfed. More so an attempt to make it to 2 weeks, than doing it with the lowest score possible—a proof of concept, if you will.

Or, try it here, in your browser

X=([...O],S=[])=>{let M,F,a,b,R,n;M=F=0;while(O.length)eval(("?S.shift())#[a,b]!2);F=a==b;?a-b)#M++#?M)#%#M=0#M=%#R=%O=[]#n=%n!n);if(F)O=n.concat(O)".split`#`[O.shift()]||"").replace(/%/g,"S.pop();").replace(/?/g,"S.push(").replace(/!/g,"=S.splice(-"));return R};const U=prompt().split``.map(e => e.charCodeAt()).join``.replace(/9/g,"").split("").map(e=>+e);R={s:20,m:0x80000000,a:1103515245,c:12345,get q(){return R.s=(R.a*R.s*+R.c)%R.m},i(v){return R.q/~-R.m*v|0},get b(){return R.i(2)},h([...a]){for(i=~-a.length;i>0;i--){j=R.i(i+1);[a[i],a[j]]=[a[j],a[i]]}return a}};R.s=U.reduce((p,c)=>p+c,0);class S{constructor(w,n=0){this.w=w;this.n=n;this.s={};this.c={}}N(T=this){return new S(T.w,T.n)}P(T=this){for(let i=0;i<T.w;i++)if(!T.c[i])T.A(i,T.n++);return T}M(s,t,T=this){let A=T.c[s],B=T.c[t];T.s[A]=T.s[A]||[];T.s[B]=T.s[B]||[];T.s[A].push(...T.s[B]);T.s[B].map(c=>{T.c[c]=A});delete T.s[B]}S(a,b,T=this){return T.c[a]==T.c[b]}A(c,s,T=this){T.c[c]=s+="";T.s[s]=T.s[s]||[];T.s[s].push(c)}*[Symbol.iterator](){yield*Object.entries(this.s)}Z(f=false,T=this){let C,b,c,v,N,r,g,l,m;C=[];b=[c=0];for(;c<~-T.w;c++){if(T.S(c,c+1)||(!f&&R.b)){C.push(b);b=[c+1]}else{T.M(c,c+1);b.push(c+1)}}C.push(b);v=[];N=T.N();if(!f){for(let[i,s]of T){let q=R.i(s.length-1);if(!q)q++;g=R.h(s).slice(0,q);v.push(...g);g.map(c=>N.A(c,i))}}r=[];C.map(c=>c.map((e,i,a)=>{l=i+1==a.length;m=!l*2;m|=1*(v.indexOf(e)!==-1);r.push(m)}));return[N.P(),r]}static F(w=10,h=10){let s=new S(w).P(),r,g=[[1]],i=0;for(;i<w;i++)g[0].push(1,1);for(let i=0;i<h;i++){[s,r]=s.Z(i===h-1);g.push(...I(r))}return g}};let I=(r, last=false)=>{let D=[1],E=[1];r.map(c=>{D.push(0,+((c&2)==0));E.push(+((c&1)==0),1)});return[D,E]};class B{constructor(w=10,h=10){this.m=S.F(w,h);this.r=0;this.G=true;this.f()}a(x=this.x,y=this.y){return this.m[y][x]}f(T=this){T.x=T.y=T.ey=1;while(T.a()!=0)T.x++;T.ex=this.m[0].length-1;while(T.a(T.ex)!=0)T.ex--}W(){return this.x==this.ex&&this.y==this.ey}d(r=this.r){return [[0,1],[-1,0],[0,-1],[1,0]][r]}L(){this.r++;this.r%=4}F(){let o=this.x,p=this.y,d=this.d();this.x+=d[0];this.y+=d[1];if(this.a()==1){this.x=o;this.y=p;this.G=false}if(this.W()){console.log("win");this.G=false}}M(r){r=this.r+r;r%=4;let m=-1,d=this.d(r),x=this.x,y=this.y;while(this.a(x,y)!=1){x+=d[0];y+=d[1];m++}return m}T(f){let ms=[1,3,0,2],v=f(ms.map(e=>this.M(e)));while(v&&this.G){this["KLFK"[v%4]].bind(this)();v>>=2}return this.G}R(f){let Y=999;while(this.G&&Y-->0)this.T(f)}}(new B()).R(a=>X(U,a))

Intended solution

the default.'s solution was very close to being exactly the same as mine, and in fact, conceptually equal to mine. However, mine has a bit tighter encoding:

I'll probably released a half-golfed, half-annotated version of the source later.

dotcomma, 819 bytes, cracked by the default.

[[,.][[,.],[.[[,.][.].]],.[[.,]]].,][,.]
[,],[[,.][[.][[[.][.].,][,.][.].,][[.][.
][.].,].[[[,.][[].[],.][[[,][,.].,]].,][
[,][.]].][,.][[,][[[,.][[[[.][.].,][,][.
][,][,.].,]].,].[[[,.][[[,][,.].,]][[].[
],].,][[,]].][,.][[,.][[[[.]][.][[[.][[.
]][[[[.]][[.][.][.].,][,.].,][.][,.].,][
,.][[.]].,][,.][.].,][[.]][,.].,][,.].][
.].,]][[.]].,]].,][,],[[[,.][.[[[,.][[].
[.],].,].][[,.][,.][,.].,]].,]][[,.].[.[
[.][,.].][[[[.][.][.][.].,][,.].,],][[[,
.][[[[[[[[[,][,.].,][,.].,][,][,.][.][.]
[.].,][.].,][.].,],],][.][.][.][.][.].,]
.,][.][.].,][,][,][,][,][,][,][[,.][[,][
,][,]].,][,][,][,][[,.][[,][,][,][,][,]]
.,][,][[,.][[[,.][[,]].,]].,][,]],.[[[,.
][[[[.][.][.].,][,][,][,.][[].[,],].,]].
,][[[,.][[[[[[[,.][.].,][.][.].,],][.].,
][.].,],].,][.][.][.][.].,][,][,][,][[,.
][[[,.][[,][,][,]].,]].,]]][.][[.]][[.]]

Try it online!

The flag is accepted.

Since this language is quite new and I've only seen two people (the inventor and me) using it so far, I tried to find a good balance between too hard and too easy.

If I've done it correctly, the code will have two valid passwords. The interpreter is written in Javascript and therefore runs on your local machine.

On my notebook it takes about five seconds to show "accepted" after entering the correct password.

Solution:

The intended solution is the number 49375. I initially wanted to use the decimal value of 0xC0DE (49374), but got things messed up in my head and ended up one number too high. The comparison function works in a way that the input and the solution are being decremented in a loop until one of them becomes zero. Then the other one must be 1 to be accepted. That means, 49376 is also a valid solution.

Other known solutions are [49375], [49376], [49375, -1] and [49376, -1]

The way this was meant to be cracked:

dotcomma is an esoteric language that is really hard to read, so I don't wanted anybody, to really "decompile" it and know exactly, what each command does, but to puzzle around with the blocks.

As already stated in my first comment, the language works a bit like Brain-Flak. The input will implicitly become the initial values in the queue and after the program ended, the content of the queue will implicitly be printed. So an empty program is a cat program.

To solve this, you first need to find the start and end of each block, what will result in something like this:

(1) [[,.][[,.],[.[[,.][.].]],.[[.,]]].,]
(2) [,.]
(3) [,],
(4) [[,.][[.][[[.][.].,][,.][.].,][[.][.][.].,].[[[,.][[].[],.][[[,][,.].,]].,][[,][.]].][,.][[,][[[,.][[[[.][.].,][,][.][,][,.].,]].,].[[[,.][[[,][,.].,]][[].[],].,][[,]].][,.][[,.][[[[.]][.][[[.][[.]][[[[.]][[.][.][.].,][,.].,][.][,.].,][,.][[.]].,][,.][.].,][[.]][,.].,][,.].][.].,]][[.]].,]].,]
(5) [,],
(6) [[[,.][.[[[,.][[].[.],].,].][[,.][,.][,.].,]].,]]
(7) [[,.].[.[[.][,.].][[[[.][.][.][.].,][,.].,],][[[,.][[[[[[[[[,][,.].,][,.].,][,][,.][.][.][.].,][.].,][.].,],],][.][.][.][.][.].,].,][.][.].,][,][,][,][,][,][,][[,.][[,][,][,]].,][,][,][,][[,.][[,][,][,][,][,]].,][,][[,.][[[,.][[,]].,]].,][,]],.[[[,.][[[[.][.][.].,][,][,][,.][[].[,],].,]].,][[[,.][[[[[[[,.][.].,][.][.].,],][.].,][.].,],].,][.][.][.][.].,][,][,][,][[,.][[[,.][[,][,][,]].,]].,]]]
(8) [.]
(9) [[.]]
(10) [[.]]

Then try out, what each block does.

Block 1 (filter): This block actually answers the default.'s question (sorry, I didn't answer it clearly. No other submission had to answer details about the password, and the "wrong password :(" was the only red herring I added to the program. So I didn't want to say "No, it's actually a five digit integer"). If you run that with different data types (numbers, strings, lists of numbers or strings), you will see that it returns the first element of a string or list, if it has multiple elements, or it will return a 1 and the element, if you enter a number or a string/list with only a single letter in it. The purpose of this becomes clear, if you add the second block to it.

Block 2 (delete first element): If you run blocks 1 and 2, you will see that the output will be empty if you input anything with multiple values. Only single numbers or single letters will remain in the queue. (Actually the default. found a bug in the programming language, because negative values should not be possible in the queue. You can't programmatically write a negative value onto the queue, and negative values won't be written to the output, but apparently they still can be read from input). So from this point, it should be clear that the password is either a number or a single letter.

Block 3 (run next block, if there's something in the queue): This will not change the output, but is there for control. You can ignore it.

Block 4 (build constants for comparison): This will build the list [49375, 96, input]. At this point, you may ask yourself, what the big number is for and that it may be important for the password.

Block 5 (run next block, if there's something in the queue): Same as block 3. Since there are three values in the queue, this will also rotate the queue, so the output is [96, input, 49375].

Block 6 (compare input and password): As stated earlier, this decrements the input and the number 49375, until one of them becomes zero. Then decrements the other another time and appends the 96 to it. The output is [49375-input (or input-49376), 96]. At this point, you should point out that you have to change the input in a way that the first value becomes something interesting, like 0, -1 or maybe 96?

Block 7 (write output): This block checks if the first value is 0. If so, it uses the second value to build the string "accepted". If not, it fills the queue with the string "rejected".

Blocks 8-10: Those are just fillers, so my submission will have a nice rectangle shape.

Ruby, 39 bytes, cracked by @EricDuminil

p eval($<.read.tr'Scfpvy.:?'"%<`(',$/)

Try it online!

Here's hoping I've managed to close the backdoor that @Sisyphus exposed in the previous version. As before, input is via STDIN and the flag is """n (with n representing a trailing newline) printed to STDOUT. Nothing is printed to STDERR.

My password: Try it online! Same idea as the crack but somewhat different implementation.

JavaScript (V8), 113 bytes

f=n=>n!=42?`${n} is a number`:`${n} is the answer to the ultimate question of life, the universe, and everything`

Try it online!

f needs to return 42 is a number.

Probably an easy one, but it's worth a shot.

JavaScript (SpiderMonkey), 52 bytes, Cracked by r3mainer

i=>(a=+i,a<a/a?a/a<-a?1/a<a:a*a>1:1<a*a?a*a<a:1/a<a)

Try it online!

Expect output is true.

Input via parameter, output via return value. Global values should not be configured before the function execute. (For example, Object.defineProperty(globalThis, 'a', { get() { return ...; }, set() { return true; } }) is not valid.)

This one could be quite easy. I expected it will be cracked in 30 min...

C (x86-64), 100 bytes, cracked by @the-default.

This will survive until someone figures out how to run Xorshift in reverse. (So probably not very long!). Requires a key of 8 characters as a command line argument. The flag is CodeGolf followed by a line break (and nothing else before or after). Liable to crash if the key is missing or less than 8 characters in length.

main(int a,char**b){for(unsigned long *x=*++b,i=59295;i--;*x^=*x<<13,*x^=*x>>7,*x^=*x<<5);puts(*b);}

Try it online!

Ruby -n, 32 bytes, cracked by @Sisyphus

^{Edit to reduce score by 1: (p eval$_) → p(eval$_)}.

!/[Scfpv.:?'"%<`(]/&&p(eval$_)

Input via STDIN. Flag is """n (three double-quote characters with trailing newline) printed to STDOUT.

Ruby, 85 bytes, cracked twice by the-default

x=gets
puts (x[0...n=x.size/2].to_i*x[n..-1].to_i).to_s(36) if x[-9..-1]=="123456789"

Try it online!

Flag is: codegolfguessmypasswordrobber001qtr5vxskd64lddb0gsyw2w4hp8zd1t0j, as a string, in STDOUT.

Explanation

Two prime numbers have been chosen, each having 50 decimal digits. One of them ends with "0123456789", and their product begins with codegolfguessmypasswordrobber when written in base 36.

p = 91642145128772682907542781226248344977333099146327
q = 15416260853069873976599113800182718102190123456789
n = p*q = 1412779214440046356547554449820888121475969772090456386542605159205021769559275444371360154172564003

This looks like an RSA factoring challenge, and factorizing the semi-prime is definitely one way to find the password. Bruteforce was explicitly forbidden for this challenge, though. And apparently, it wasn't too hard anyway to factorize n with an open-source program called cado-nfs. I should probably have picked a longer semiprime, e.g. RSA-200.

There's a (badly hidden) backdoor : String#to_i is happy to convert any string to an integer.

Extraneous characters past the end of a valid number are ignored.

So "1x000123456789".to_i gets converted to 1, and the challenge becomes trivial. It's now possible to "factorize" n as n*1.

Python 3, 73 bytes, cracked by pxeger

Hopefully this time there are no loopholes.

s=input()
assert not{*s}&{*'()[]{}'}
eval(s,{'__builtins__':{}})(**{0:0})

Try it online!

Just as before, the password is inputted via STDIN, the flag is (nothing) and should be printed to STDERR. That means no output to STDERR.

Python 3, 42 bytes, cracked by pppery

Just a single line of Python.

eval(input(),{'__builtins__':{}})(**{0:0})

Try it online!

The password is inputted via STDIN, the flag is (nothing) and should be printed to STDERR. That means no output to STDERR.

Python 3.8 (pre-release), 93 bytes, cracked by pppery

from functools import*;lambda a,b,c:(d:=reduce)(lambda e,f:e[f],c,d(getattr,b,__import__(a)))

Try it online!

• Input is function arguments, output is function return value.
• Flag is the string pxeger (my username)

pppery didn't find my intended solution, and noone else has, but here it is:

The function

Given that:

So we need to:

Specifically

Python lets you

Then

Finally,

So the whole solution is

R, 60 bytes, cracked by Paul

function(x) chartr("zyxwvu", "RRRRRR", tolower(x[1] + x[2]))

Try it online!

As in my previous challenge, the flag to output is the string "R". In other words, you need to find x such that f(x)=="R" is TRUE.

The solution is e.g. as.roman(c(2, 3)). This object is represented as c(II, III); it is of mode numeric but of class roman. Since it is numeric, addition works, giving the roman integer V. But since it is of class roman, tolower coerces it to string, giving the string "v". Then chartr translates this to "R".

JavaScript, 10428 bytes, cracked by ovs

[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]])()([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[!+[]+!+[]]]+(([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]]+[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+([][[]]+[])[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(+(+!+[]+[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+[!+[]+!+[]]+[+[]])+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]]+(!![]+[])[+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]+[+!+[]])[(![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+[+!+[]]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]]((!![]+[])[+[]])[([][(!![]+[])[!+[]+!+[]+!+[]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([![]]+[][[]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]](([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]]+![]+(![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])()[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[+[]])[([![]]+[][[]])[+!+[]+[+[]]]+(!![]+[])[+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+([![]]+[][[]])[+!+[]+[+[]]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]]()[+!+[]+[+[]]])+[])[+!+[]])+([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]()[+!+[]+[!+[]+!+[]]])())

Because no one said there was a character limit :)

Fiddle

The flag is cracked! otherwise there is no output.

Arn, 19 bytes, cracked by r3mainer

€weL˜ù┼󪘛’U•žfcmº

I would provide the unpacked form, but it's rather trivial to decode adds to the challenge if you have to decode it yourself. Not terribly difficult, but it requires you to access the source code. The flag you want is:

7.9228162514264337593543950336e+28

this was done in the online interpreter. This shouldn't be too difficult, and multiple inputs should theoretically work. However, I encourage you to try and figure out the one I used (you will know immediately if you found the right one).

Solution + Explanation

The flag r3mainer used was J0e_Biden!. The flag I intended to be the solution will remain hidden, as to encourage others to try :). However, to make it easier, here is an explanation for the program :*:*((|:(|):}):i0^:i"n

:* Square
  :* Square
      ( Begin expression
        (
            |: Bifurcate*
              (
                | Fold with concatenation (remove spaces)
                  _ Variable initialized to STDIN; implied
              ) End expression
          :} Tail
        )
      :i Index of
        0 Literal zero
    ^ To the power of
        _ Implied
      :i
        "n" literal string

• Note: bifurcate is currently broken, and this program takes advantage of that. Basically, |:(...):} is a synonym for reversing the string ... (don't you love bugs?)

JavaScript (SpiderMonkey), 66 bytes, cracked by @user

if (readline() === ([0][1]+"").slice(4,8)) console.log('cracked!')

Try it online!

The flag is the string cracked!

Haskell, 246 bytes, cracked by ovs

infix 0#
0:p#x=p#1:x
1:p#x:z=p#x:x:z
2:p#x:y:z=p#(y+x):z
3:p#x:y:z=p#(y-x):z
4:p#x:y:z=p#(y*x):z
5:p#x:y:z=p#div y x:z
6:p#x:y:z=p#y:x:y:z
7:p#x:y:z=p#y:x:z
c:p#x|(q,_:r)<-span(<c)p=r#until((==0).head)(q#)x
_#x=x
main=readLn>>=print.(#[]).take 60

Try it online!

Input is taken over STDIN, and output is printed to STDOUT. The flag is the output string: [2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109,113,127,131,137,139,149,151,157,163,167,173,179,181,191,193,197,199,211,223,227,229,233,239,241,251,257,263,269,271,277,281,283,293,307,311,313,317,331,337,347,349,353,359,367,373,379,383,389,397,401,409,419,421,431,433,439,443,449,457,461,463,467,479,487,491,499]

(Those are the primes from 2 to 499.)

><>, 4 bytes

i10p

Try it online!

The flag is Something smells delicious... printed to STDOUT, and takes input form STDIN.
Invalid keys may not always terminate the program.

Not a difficult one, but I like this feature.

05AB1E (legacy), 8 13 bytes, cracked by @ovs

F}žhм9£.ER.V*

+5 bytes to close a different crack found by @ovs (although he's free to post it as an actual crack instead if he chooses to).

Try it online.

Expected output: n137438953472n (where the n are of course newlines).

Code explanation:

F              # Loop `N` in the range [0, input-1)
 }             # Close the loop
  žhм          # Remove all digits
     9£        # Only keep the first 9 characters
       .E      # Evaluate and execute as Python code
         R     # Reverse
          .V   # Evaluate and execute as 05AB1E (legacy) code
            *  # Multiply two values
               # (after which the result is output implicitly with a single trailing newline)

Tip 1: the program + intended solution only works in the legacy version of 05AB1E (built in Python 3) for two reasons. This won't work in the latest 05AB1E version (built in Elixir), where all these builtins as mentioned in the code explanation above will also act the same as described.
Tip 2: it won't time out on TIO, so an input like 274359834731, which would result in 137438953472n (note it's missing the intended leading newline) isn't the intended solution, since the loop takes too long (no longer possible after the 5 bytes had been added). The intended solution runs in less than 0.2 seconds on TIO.
Tip 3: one of two reasons mentioned in tip 1 is a bug with .E and a certain type of input (which is ALSO in @ovs' initial crack), that I abuse to get the intended result.
Tip 4: there are three loose inputs (separated with newline delimiter), and the first and third inputs are the same

JavaScript (SpiderMonkey), 23 bytes, Cracked by Sisyphus

a=readline()
print(a+a)

Try it online!

• Expect output: aaa
• Input / Output use stdin, stdout

Jelly, 4 bytes, cracked by Bubbler

OÆTP

Try it online!

Outputs 160.58880817718872.

¯_(ツ)_/¯

Python 3, 85 bytes, cracked by r3mainer

import re,time
b=input()[:40]
a=time.time()
re.match(b,b)
if time.time()-a>9:print(0)

Try it online!

Prints 0. Works on TIO.

R, 29 bytes, cracked by pppery

function(x) intToUtf8(cos(x))

Try it online!

The flag to output is the string "R".

The solution is 5.1i.

Although $forall xinmathbb R, -1leqcos xleq1$, those bounds don't hold for complex $x$: $cos(a+ib)=cos xcosh y -i sin xsinh y$, which is unbounded. We want to find $x$ such that $ cos x=82$ (the ASCII codepoint of R); pppery gave the answer x=5.0998292455...i. The shorter x=5.1i works, because intToUtf8 can take a complex argument and cast is as integer by ignoring the imaginary part, and rounding down the real part to an integer.

PHP, 89 bytes, cracked by Benkerd22

<?php
$x=file_get_contents('php://stdin');
if(!preg_match('/.*golf.*/',$x))echo trim($x);

Try it online!

Outputs golf, exactly.

Wolfram Language (Mathematica), 15 bytes, cracked by w123

#//.a_:>Head@a&

(Edited to reduce byte count. Solution should be the same; all the unintended solutions I can think of should be trivial to adapt.)

Flag: flag.

Input by function argument, and output by return value. Try it online!

Python 2, 94 bytes, cracked by Christian Mann

^{Edited to reduce score. See revision history for ungolfed version.}

Another Python answer.

import re,sys
p=sys.stdin.read()
if re.match('^[excdhrkbslim_=:;,.ants]*$',p):exec p;print a

Try it online!

Flag is 0xc0de. The output should be to STDOUT.

My solution was basically the same as Christian's:

The regex only accepts a very limited number of characters. Notable exclusions are all kinds of brackets, string delimiters, almost all operators and the p for print and input.
a='0xc0de' doesn't match the regex, and a=hex(49374) neither.

With these restriction I don't know of a way to call any function that returns a value. I would be interested in counterexamples ;).
^{One exception is a==b, which calls a.__eq__(b), but since q is not available, you can only do this with builtin types.}

The idea is to use the fact that print a calls a.__str__ to get a string representation of the object a. This means we need to define an object a with a custom __str__ method, which is then called by string.
Instantiating objects is not possible without (), but luckily we can define methods on classes rather than instance objects using metaclasses.
The metaclass is required to have an __init__ function, that takes three arguments and returns None. A good choice for this is an __init__ function of a different class.

This result into the final solution:

class b:
    __str__ = 49374 .__hex__
    __init__ = 0 .__init__
class a:
    __metaclass__ = b

Try it online!

This doesn't work in Python 3 for two reasons:

• int's dont have a __hex__ method anymore.
• The syntax for metaclasses has changed. In Python 3 this would look like class a(metaclass=b): ..., which uses forbidden brackets

JavaScript (V8), 25 bytes, Cracked by user

y=s=>(l=s.length)?l:l/l|1

Try it online!

The flag is 0.
Input: function parameter.
Output: returned value of function.

Perl 5 (-n), 33 bytes, Cracked by Neil

length()<28 && !/w/ && eval eval

Try it online!

The flag is Flag. The input is stdin and output stdout.

!@#$%^&*()_+, 104 bytes, cracked by @thedefault

*^(%  _+*^)%(0_+%)%  _+^$($_^_$_^_$+!!!!!!!!!+++++++++^$)+_^_  _+$(_^^^^^^^^^^_$^$)+xx_+$(_0+_$^$)+!!@@@

The flag to this program is $$$ output to STDOUT.

I guarantee that the flag will appear in at least 5 seconds given the correct password.

Try it online!

What does it even do?

*^(%  _+*^)%(0_+%)%  _+^$($_^_$_^_$+!!!!!!!!!  # Push the password integer...
+++++++++^$)+_^_  _+$(_^^^^^^^^^^_$^$)+        # ...from STDIN onto the stack
xx_+$(_0+_$^$)+                                # Divide by the ASCII value of 0 i.e 48
!!@@@                                          # Print the result as a character thrice.

Therefore:

$x = 48 · 36 = 1728$

Where x is the password.

FYI 36 is the ASCII value of $.

Python 3.8, 95 bytes, cracked by wastl

import os;(c:=os.getenv("A")).isidentifier()and c not in"printinput"and eval(c)(os.getenv("B"))

Input is via environment variables. (no TIO link because it doesn't support them). Flag is the_flag.

@wastl did not find my intended solution - theirs was much simpler. Here is what I indended:

PYTHONBREAKPOINT=builtins.print A=breakpoint B=the_flag python -c 'import os;(c:=os.getenv("A")).isidentifier()and c!="print"and eval(c)(os.getenv("B"))'

The PYTHONBREAKPOINT environment variable describes a function to be called when you use breakpoint(). Python has a lot of weird implicit behaviours like this. I intentionally left "input is environment variables" vague so you would think it would only be A and B

Python 2.7, 189 bytes, cracked by ovs

import re

inp = raw_input()
if not re.match(r"^[wd=]*$", inp):
    quit()
exec(inp)

a = raw_input()
b = raw_input()
flag = a == b

if flag == True:
    print("%s %s"%(a, b))

Try it online!

Flag is The Flag, output to STDOUT. This might be a bit easy, but hopefully still fun!

I'll get things started off with one that probably won't be extremely difficult but may take some thought.

Python 3, 78 bytes: cracked by wastl

while 1:
	try:l=input()
	except:l=''
	exec(l,{},{"exit":0,"quit":0})
	print(1)

Try it online!

Flag is nothing. As in, . The program should not output anything.