The website does not need to be unhackable. It needs to be encrypted, but low level works. Anything but plaintext. It needs to use OTPAuth to verify the users. Other than that is up to your discretion. You do not need to make it look good, so long as it works.