As a beginner, I wrote the contract below for learning purposes, aiming to create a "Safe Messaging System":

pragma solidity ^0.4.24;

contract SafeMessage {

string message;
string password;
string enterPassword;

function sendMessage(string _message, string _password) public {
       require (bytes(_message).length > 0 && bytes(_password).length > 0 );
       message = _message;
       password = _password;

function readMessage (string _enterPassword) view public returns (string) {
   require (stringsEqual(password, _enterPassword) == true);
   return (message);

function stringsEqual(string storage _a, string memory _b) internal pure returns(bool) {
    bytes storage a = bytes(_a);
    bytes memory b = bytes(_b);

    if (keccak256(a) != keccak256(b)) {
        return false;
    return true;

So, with the code above, I can set a message, and calling "readMessage" will only return the message with the right password. The problem is, from what I understand, the data stored in string form (message & password) can be read by somebody else. Is that true? And how does that work?

Also, for the password, I could just take its hash instead of storing it directly as string, but that wouldn't solve the problem if the message can be read otherwise anyway. If what was mentioned in the previous paragraph is true, how could one actually create a "Safe Messaging System" with a smart contract?

2 Answers 2


Yes, everything in the blockchain is public and can be read by anyone.

See the "Nothing is Hidden" section of https://programtheblockchain.com/posts/2018/01/02/making-smart-contracts-with-public-variables/.

There is no way for a smart contract to keep a secret, so the only secrets that can exist on the blockchain are ones that are encrypted and decrypted outside of the blockchain. (I.e. encrypt, then store on the blockchain, then retrieve, then decrypt. Once encrypted, it would also be safe to just post the data on Twitter.)

  • That's what I thought. Thank you very much for clarifying. Yeah, no sense in making a smart contract for that then. Oh, but out of curiosity, what is the process someone has to go through to read that data? Commented Aug 19, 2018 at 16:54
  • About 4 lines of JavaScript and a bit of knowledge about storage layout in solidity. Web3 provides the getStorageAt method, which can be used to read directly from smart contract storage Commented Aug 19, 2018 at 18:53

Etherscan makes it easy read the code and state variables of any contract, and even interact with it.

Here is a direct example: the CryptoKitties contract: https://etherscan.io/address/0x06012c8cf97bead5deae237070f9587f8e7a266d#readContract

For simple state variables, you see the value, e.g., paused = False bool

For mappings, you get a form to enter the key: e.g., kittyIndexToOwner takes a uint256 representing the kitty index, and clicking 'Query' returns owner address.

For public or external functions, you get a form for entering all the arguments, e.g., canBreedWith takes a _matronId (uint256) and a _sireId (uint256), returning a bool.

  • I believe the question was about private variables. (Etherscan, to my knowledge, doesn't provide a simple tool to access those.)
    – user19510
    Commented Aug 19, 2018 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.