Let's start off easy... inspect the source code and check the varify function. See if you can find the password