Let's say I want to deploy a simple static website (with no backend server) with some protected pages only visible after entering a password.
I could write a hardcoded salted hashed password and encrypt the protected data with it, but the user can still go through the minified JS bundle and find the block that performs the password check which would necessarily have to contain the hashed password or the raw password + hashing algorithm (otherwise how could it check for password correctness or decrypt the content?). I could improve this by performing the password checking in WebAssembly, but with some time and knowledge that could also be decompiled and cracked.
It seems to me that fundamentally in any case where the password checking or protected content exists on the client's machine, it is impossible to have any real security that isn't just security by obfuscation. However then I would ask is this also true for any password protected files with open source specifications and readers like
I also see packages like StatiCrypt and PageCrypt and am wondering if these are trivial to crack, and if not how do they work?
TLDR - On a website using backend authentication the user cannot access the password checking code nor protected data until providing the correct password. However if the data is on the client (in cases like a static site or a password protected file) the user has full access to the encrypted data as well as the code that checks passwords and decrypts the data, so is that necessarily only security by obsurity?