Password-protected links
a lock the destination never needed.
Put a password in front of any URL — a deck, a PDF, a pricing page — without touching the destination. Visitors type it once and go straight through, and wrong guesses never reach your analytics.
Quick answer
A password-protected link asks for a password before it forwards. The gate sits on the link rather than the destination, so it works on any URL, including ones with no login of their own. The password is stored as a scrypt hash, attempts are rate-limited, and a click is recorded only after a correct answer.
This link is protected
Enter the password to continue to the destination.
What a visitor sees. The destination URL isn't in this page at all.
How it works
The visitor sees a prompt, not your destination
Opening the link returns a small page with one field. The destination URL is never in that page's markup, so viewing source reveals nothing.
The password is checked on the server
It is stored as a scrypt hash with a per-link salt and compared in constant time. A wrong answer is rejected without disclosing anything about the right one.
A correct answer forwards straight through
No account, no cookie to accept, no second page. The click is recorded at that moment — so what you see in analytics is arrivals, not attempts.
What it doesn't do
Worth knowing before you rely on it for something that matters.
It protects the route, not the file.
Once someone is through, they hold the destination URL and can share it. If the destination is public, the password controls who finds it through your link — not who can open it at all. For a file that must stay private, use a host with its own access control and protect the link on top.
It is not encryption.
Nothing about the destination is encrypted with your password. This is an access gate on a redirect, which is the right tool for an unlisted deck or a private brief, and the wrong tool for regulated data.
Guessing is rate-limited, not impossible.
Unlock attempts are throttled per link. A four-character password will still fall to someone determined, so pick something you would be comfortable putting in a calendar invite.
How to set it up
- 1Open a tracked link and go to the Rules tab.
- 2Type a password — at least 4 characters — and save. It is hashed immediately; nobody, including us, can read it back.
- 3Share the link and the password separately. The link works everywhere a link works; the password does not travel with it.
Sharing something for a fixed window? Give the same link an end date and it closes on its own, password or not.
Password-protected links FAQ
What is a password-protected link?
A short link that asks for a password before forwarding. The visitor sees a single prompt; entering the right password sends them to the destination, exactly as the link would have done on its own.
Do I need the destination to support passwords?
No, and that is the point. The gate lives on the link, so you can put a password in front of a Google Doc, a Notion page, a PDF on a plain web server, or any URL at all — without changing anything at the destination.
Can you see my password?
No. It is hashed with scrypt and a per-link salt the moment you save it, and only the hash is stored. If you forget it, you set a new one — there is nothing to recover.
Do failed attempts show up in my analytics?
No. A click is recorded only after a correct password, so a wrong guess costs you nothing and never appears in your numbers. It also means your click count is people who actually got in.
Does every visitor have to type it, every time?
Yes. There is no session and no cookie carried between visits, which keeps the gate honest and means a shared device doesn't leave the link open behind you.
Can I combine a password with other rules?
Mostly yes. A schedule is checked first, so an expired link never shows a prompt, and country rules apply before the password too. The one exception is a Pinpoint link — the password screen would replace the location notice, so the two can't be used together.
Can I remove the password later?
Yes, at any time and on any plan. Only switching protection on needs a paid plan; clearing it never does.
Which plans include password protection?
Pro ($9.99/mo) and above. It is not part of Starter.
More ways to control a link
Expiring links
Set the day a link starts working and the day it stops.
Device targeting links
iPhones to the App Store, Android to Play, desktop to your site.
Link retargeting
Fire your own ad pixel on a click to a page you don't own.
Link click tracking
Measure clicks, devices and locations on every link.
Tracking pixel generator
A 1×1 pixel that logs opens and views in email and on pages.
Lock a link, not a document
Start free with 10 tracked links and full analytics. Passwords come with Pro at $9.99/mo.
Create a tracked link