Blog · Security
Password-protected links: when to use them for private material
A password-protected link works well for private material, but it guards the link, not the file. When it fits, when it falls short and how to choose and share the password.
A password-protected link asks for a password before it sends anyone to its destination. It's a good fit for material that isn't public but isn't top secret either: a press kit before a launch, course materials, a wholesale price list or a design proposal for a client. Here's how it works, when it's the right tool, when it isn't enough and how to share the password without defeating the purpose.
In short:
- The password protects the short link, not the file or page it points to.
- It's right for private material, not for personal or sensitive data.
- Send the password through a different channel than the link.
- Pair it with an expiry date so access ends when the project does.
- The clicks in your stats are openings with the correct password.
How a password-protected link works
Whoever opens the link doesn't go straight to the destination. First they see a page saying the link is protected and asking for the password:
- If they type it correctly, the link redirects them to the destination like any other short link.
- If they get it wrong, they see an error and can try again. Repeated attempts are rate-limited to slow down anyone guessing at random.
- Every time someone opens the short link, they're asked for the password again.
In linko, link passwords are part of the Pro plan (see the plan comparison). They need at least 4 characters, aren't stored in readable form, and can be changed or removed whenever you like without changing the short address. And the preview you get by adding + to the end of a link doesn't reveal the destination of protected links.
When it makes sense to protect a link
A password fits when you want a specific group to see something, but it wouldn't be a disaster if an outsider got a look. Typical cases:
- Press: the press kit, photos and release ahead of an embargo date.
- Courses and communities: recordings, templates or worksheets for one cohort of students.
- Clients: proposals, mockups or deliverables for a project in progress.
- Wholesale buyers and resellers: a catalog with pricing you don't want on your public site.
- Launches: early access for your waitlist before you open to everyone.
- Private events: the link to an online meeting room or the agenda for an invite-only event.
When it's not enough
This is the most important point: the password guards the door of the short link, not what's behind it. The destination (a document in your cloud storage, a shared folder, a page on your site) still has its own address. Once the link is unlocked, that address shows up in the browser, and anyone could copy and share it.
| Material | Is a password enough? | Better option |
|---|---|---|
| Press kit | Yes | Password plus an end date |
| Course materials | Yes | A new password for each cohort |
| Contracts or pay stubs | No | Share with named people from your cloud storage |
| Customer or health data | No | A tool that requires signing in |
If the material includes personal information, Social Security numbers, ID documents, medical records or financial details, use the access controls of the service where it's stored: share only with specific email addresses, require sign-in or set view-only permissions. A password-protected link is a convenient layer, not a safe.
How to choose and share the password
- Use a unique password. Never the one you use for your email or social accounts.
- Go for a short phrase rather than a single word: "fall-wholesale-catalog" is easier to read out loud and harder to guess than "1234."
- Send it through another channel. The link by email and the password by text, or the password in class and the link in your course platform. If someone forwards the email, the password doesn't travel with it.
- Don't post it next to the link, and don't put it in the link's title or in the post itself.
- One link per group. If you share the same material with press and with resellers, create two links with different passwords. You can shut one down without affecting the other and see each group's clicks separately.
- Change it when the group changes. When a new cohort starts, change the password: past students lose access and the link stays the same.
Combining a password with an expiry date
Plenty of private material also has an end date: course access lasts three months, and a client proposal stops mattering once the contract is signed. If you add an expiry date on top of the password, the link stops working on its own at that point, and you don't have to remember to close it. This guide on expiring links has more ideas.
You can also go the other way: protect a press kit until the embargo lifts, then remove the password on launch day so the same link becomes public. And if you need to cut off access right away, say because the password leaked, you can pause the link while you decide what to do. While it's paused, it shows a notice instead of redirecting.
What the statistics tell you
On a protected link, clicks are only counted when someone enters the correct password and reaches the destination. Viewing the password page without unlocking it doesn't count. That makes the click count a fairly faithful measure of how many times the material was opened.
With Pro, you can also see which countries and systems those openings come from. If a link meant for a team in one city starts getting clicks from a dozen countries, the password has probably traveled further than you intended, and it's a good time to change it.
Frequently asked questions
Can someone see where the link goes without the password?
The + preview doesn't show the destination of protected links. But anyone who has already unlocked it sees the final address in their browser and could share it, which is why it's not the right tool for sensitive material.
What happens if someone types the wrong password?
They see an incorrect-password message and can try again. If someone makes a lot of attempts in a short time, they'll have to wait a while before trying again.
Can I change the password without changing the link?
Yes. You change or remove the password in the link editor and the short address stays the same, so you only need to send out the new password, not a new link.
Do people have to enter the password every time?
Yes. The password is requested every time someone opens the short link, so having the link bookmarked isn't enough to get in.
What happens to the password if I leave Pro?
The link keeps working with its password. What you can't do is change it or protect new links until you're back on Pro. If you don't have an account yet, you can create one for free and upgrade when you need to.