diff --git a/README.md b/README.md
index d7465ff..5747bf0 100644
--- a/README.md
+++ b/README.md
@@ -15,8 +15,4 @@ Open `index.html` in a browser to use it.
 
 ## Secret
 
-The current demo secret is `change-me`. Before publishing, replace `AUTH_SECRET_HASH` in `app.js` with the SHA-256 hash of your real secret. This is a simple client-side gate, not strong server-side security.
-
-```sh
-printf 'your-secret' | sha256sum
-```
+The current demo secret is `change-me`. Before publishing, replace `AUTH_SECRET` in `app.js` with your real secret. This is a simple client-side gate, not strong server-side security.
diff --git a/app.js b/app.js
index 6e848c3..808d993 100644
--- a/app.js
+++ b/app.js
@@ -1,9 +1,7 @@
 const STORAGE_KEY = "routes.links.v1";
 const AUTH_SESSION_KEY = "routes.authenticated.v1";
-// SHA-256 hash of the secret. Default secret is "change-me".
-// Replace this hash before publishing. Generate a new one with:
-//   printf 'your-secret' | sha256sum
-const AUTH_SECRET_HASH = "e2186dbdb1bb4193608605e84f33208765b5693b55edd4f730a719a100eeea6f";
+// Simple shared secret. Change this before publishing if needed.
+const AUTH_SECRET = "change-me";
 
 const authScreen = document.querySelector("#auth-screen");
 const authForm = document.querySelector("#auth-form");
@@ -41,19 +39,11 @@ if (sessionStorage.getItem(AUTH_SESSION_KEY) === "yes") {
   lockApp();
 }
 
-async function authenticate(event) {
+function authenticate(event) {
   event.preventDefault();
   authMessage.textContent = "";
 
-  let hash;
-  try {
-    hash = await sha256(authSecretInput.value.trim());
-  } catch {
-    authMessage.textContent = "Authentication needs HTTPS, localhost, or a modern browser.";
-    return;
-  }
-
-  if (hash !== AUTH_SECRET_HASH) {
+  if (authSecretInput.value.trim() !== AUTH_SECRET) {
     authMessage.textContent = "Wrong secret.";
     authSecretInput.select();
     return;
@@ -79,12 +69,6 @@ function lockApp() {
   authSecretInput.focus();
 }
 
-async function sha256(value) {
-  const data = new TextEncoder().encode(value);
-  const digest = await crypto.subtle.digest("SHA-256", data);
-  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-
 function loadRoutes() {
   try {
     return JSON.parse(localStorage.getItem(STORAGE_KEY)) ?? [];