For a game I am working on, one of the build targets is the Unity Webplayer, which does not support saving file I/O at all. However, as it's an action/adventure game based on Zelda 2: The Adventure of Link, I would like to provide my players the capability to save their game somehow.
In light of the webplayer limitations, I was going to circumvent it by creating a password system that the user could simply enter to resume where they left off. Said password would convey various things about game state, such as event flags, and picked up item flags (true to the game this is based off of, loading a game restarts the player in a pre-determined location.) This is also convenient for other modes, because the save system would be merely responsible for storing this password, as the password is a compressed version of the game's state.
My understanding is ideally, said setup would just entail creating a series of bits, represented by a complex character (such as, a digit or hexadecimal character) which could be stored in some larger value, then unpacked when entered by the user.
Of course, there's a problem, and that's security. I have to assume some less-honest player knows the sequence of flags and how to recreate them. From what I understand, a way to get around that is to append some sort of checksum to the bit sequence. If that checksum fails, then the system knows that the code is bogus, and to do nothing at all. Of course, I would also assume that the attacker would be aware of said checksum's existence.
Question: what are some good ways I would go about securing a save-state password as described above to make it less-able to be gamed by cheaters?