I want everybody who has the right password to be able to change specific settings on my page. To achieve this my rules for Firebase look like this:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read;
      allow update: if request.resource.data.pw == "WordPass";
    }
  }
}

This works as intended but the problem is that ofc Firebase saves the "pw" attribute in the Firestore which then can be read by everyone....

How can I make Firebase to not store this specific attribute, but still keep a simple approach without email authentification?