If this uses CSS to show/hide content, then the content is still contained within the HTML source code — so it's not truly hidden.

So if I make a challenge that if you guess the right password, you get to see my special secret, then all one would have to do is view their own HTML source code. That would be cheating!

To counter that, perhaps entering the right password lets you pull the content from the server. That way nothing is stored on your html webpage.