Guide · Create and share
Password-protect a short link
A link for a small group — a document, a price list, a draft — can ask for a password before it shows anything. This guide covers what the lock protects, what a good password looks like here, and what the lock does not do.
What the lock does
A protected link opens to a page that asks for the password and nothing else. The destination, its title and its address stay hidden until the right password is submitted; a wrong one gets an error and the gate again. The check is a POST to the link's /unlock path — a form, not a URL parameter, so the password never lands in the address bar, a log line or a share sheet (RFC 3986 reserves the userinfo part of a URI for credentials, and this service refuses links that hide them; a password in a query string is the same mistake in modern dress).
What a good password looks like here
NIST SP 800-63B asks passwords to be checked against length and breach lists rather than composition rules. The advice that survives in a share-link context: make it long, make it a phrase, share it through a different channel than the link — a message says the link, a call says the password.
- Four words beat one word and three symbols.
- Case matters: the gate says so before anyone types.
- Change it by making the link again if it leaks; the old link dies on its expiry as always.
What the lock does not do
It is one shared password, not accounts: whoever has it passes, and it cannot tell two holders apart. Rate limiting slows guessing from one address, and a million-guess attacker against a four-word phrase is the same problem NIST prices out of range. For anything that must be confidential rather than merely unlisted, send it through a channel that encrypts, and treat this gate as the door in front of it.
Questions
Where do I set the password?
Under More options on the home page, in the Password field. Free and premium links can carry one.
Is the password sent in the URL?
No. The unlock is a form POST; the address never carries the password.
Can several people use the same protected link?
Yes. The password is shared, not personal: everyone who has it opens the link.
What happens to a protected link when it expires?
It expires like any other link: the gate page reports the expiry instead of asking for the password.
Sources
The documents this guide's statements rest on. Each link opens in a new page.