It's absolutely not safe!

And as Foxxxey says, you could create and save a hash of the password off-chain and save it in the smart contract. But this is no good anyways because of the Frontrunning attack. When a user sends a transaction with the "password" to access the functionality in the smart contract, the transaction will sit in the mempool waiting to be mined, and attackers and miners will see the password and will be able to create another transaction with higher gas price than yours so it has more priority and will probably be mined and executed before yours.

Also, there is nothing really private in a smart contract or blockchain. You could declare the password variable as:

bytes32 private password;

and it wouldn't make any good, because any value in a smart contract storage can be accessed directly, with something like:

await web3.eth.getStorageAt(yourSmartContractAddress, indexOfTheStateVariable);

In your case, since your password variable is the first declared, its index in storage would be 0:

await web3.eth.getStorageAt(yourSmartContractAddress, 0);

It's absolutely not safe!

You could create and save a hash of the password off-chain and save it in the smart contract. But this is no good anyways because of the Frontrunning attack. When a user sends a transaction with the "password" to access the functionality in the smart contract, the transaction will sit in the mempool waiting to be mined, and attackers and miners will see the password and will be able to create another transaction with higher gas price than yours so it has more priority and will probably be mined and executed before yours.

Also, there is nothing really private in a smart contract or blockchain. You could declare the password variable as:

bytes32 private password;

and it wouldn't make any good, because any value in a smart contract storage can be accessed directly, with something like:

await web3.eth.getStorageAt(yourSmartContractAddress, indexOfTheStateVariable);

In your case, since your password variable is the first declared, its index in storage would be 0:

await web3.eth.getStorageAt(yourSmartContractAddress, 0);

It's absolutely not safe!

And as Foxxxey says, you could create and save a hash of the password off-chain and save it in the smart contract. But this is no good anyways because of the Frontrunning attack. When a user sends a transaction with the "password" to access the functionality in the smart contract, the transaction will sit in the mempool waiting to be mined, and attackers and miners will see the password and will be able to create another transaction with higher gas than yours so it has more priority and will probably be mined and executed before yours.

Also, there is nothing really private in a smart contract or blockchain. You could declare the password variable as:

bytes32 private password;

and it wouldn't make any good, because any value in a smart contract storage can be accessed directly, with something like:

await web3.eth.getStorageAt(yourSmartContractAddress, indexOfTheStateVariable);

In your case, since your password variable is the first declared, its index in storage would be 0:

await web3.eth.getStorageAt(yourSmartContractAddress, 0);

It's absolutely not safe!

And as Foxxxey says, you could create and save a hash of the password off-chain and save it in the smart contract. But this is no good anyways because of the Frontrunning attack. When a user sends a transaction with the "password" to access the functionality in the smart contract, the transaction will sit in the mempool waiting to be mined, and attackers and miners will see the password and will be able to create another transaction with higher gas price than yours so it has more priority and will probably be mined and executed before yours.

Also, there is nothing really private in a smart contract or blockchain. You could declare the password variable as:

bytes32 private password;

and it wouldn't make any good, because any value in a smart contract storage can be accessed directly, with something like:

await web3.eth.getStorageAt(yourSmartContractAddress, indexOfTheStateVariable);

In your case, since your password variable is the first declared, its index in storage would be 0:

await web3.eth.getStorageAt(yourSmartContractAddress, 0);