Guess my password (cops' thread) Inspired by this challenge, which got closed. This is meant to be an easier, but no less interesting version of that.
This is the cops thread of a cops-and-robbers challenge. For the robbers thread, see here.
Cops will provide a program/function and a flag. Robbers will try to guess a password such that, when the password is given to the cop's program, the flag is outputted.
Basic rules

The language used should be provided.
The flag, which can be an integer, string, or value of any other type, should be provided.
The flag may be printed to STDOUT, returned from a function, or outputted using any of the other standard output methods, as long as you specify how it will be outputted.
The program/function can take the password through STDIN, as a function argument, or using any of the other standard input methods, as long as you specify how the it will be inputted.
A free online compiler/interpreter should also be linked, preferably with the cop's code already pasted in and ready to run.

Some more rules

There must be at least one valid password that causes your program to return the flag, and you should know at least one of those passwords when posting your answer.
In case of a function submission, the cop should also include a full runnable program including the function either in the answer or in the linked online compiler/interpreter.
If it is at all ambiguous what the type of the flag is, it must be specified.
If a cop's description of the output is ambiguous (e.g. &quot;HashSet(2, 1) should be printed&quot;), robbers are allowed take advantage of that (e.g. print the string &quot;HashSet(2, 1)&quot; instead of an actual hashset)
Forcing robbers to simply brute force the password is not allowed.
The program must take input, and must output the flag when given the correct password. When not given the correct password, you are free to error, output something else, or immediately terminate. If your program never halts if given the wrong password, you must tell robbers of this behavior so no one waits around for the program to output something.

Cops's score will be the number of bytes their code takes up.
Cop answers will be safe if they haven't been cracked for two weeks.
Example
Cop:

Scala, 4 bytes
x=&gt;x

Flag: Yay, you cracked it! (an object of type String is returned from the lambda above)
Try it online!

Robber:

Password: the string &quot;Yay, you cracked it!&quot;
Try it online!

Find Uncracked Cops


&lt;script&gt;site='meta.codegolf';postID=5686;isAnswer=false;QUESTION_ID=213962;&lt;/script&gt;&lt;script src='https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js'&gt;&lt;/script&gt;&lt;script&gt;jQuery(function(){var u='https://api.stackexchange.com/2.2/';if(isAnswer)u+='answers/'+postID+'?order=asc&amp;sort=creation&amp;site='+site+'&amp;filter=!GeEyUcJFJeRCD';else u+='questions/'+postID+'?order=asc&amp;sort=creation&amp;site='+site+'&amp;filter=!GeEyUcJFJO6t)';jQuery.get(u,function(b){function d(s){return jQuery('&lt;textarea&gt;').html(s).text()};function r(l){return new RegExp('&lt;pre class="snippet-code-'+l+'\\b[^&gt;]*&gt;&lt;code&gt;([\\s\\S]*?)&lt;/code&gt;&lt;/pre&gt;')};b=b.items[0].body;var j=r('js').exec(b),c=r('css').exec(b),h=r('html').exec(b);if(c!==null)jQuery('head').append(jQuery('&lt;style&gt;').text(d(c[1])));if (h!==null)jQuery('body').append(d(h[1]));if(j!==null)jQuery('body').append(jQuery('&lt;script&gt;').text(d(j[1])))})})&lt;/script&gt;
PHP, 89 bytes, cracked by Benkerd22

&lt;?php
$x=file_get_contents('php://stdin');
if(!preg_match('/.*golf.*/',$x))echo trim($x);

Try it online!
Outputs golf, exactly.