Password-protected links: what they protect and what they do not

A password on a short link puts a gate in front of the redirect. Someone opens gc.mw/abcd, gets a small page with one field, types the password, and only then is sent to the destination. Nothing about the destination is revealed before that — not the URL, not the title, not the preview image.

Understanding exactly where that gate sits is what tells you when to use it.

What it actually stops

Casual access. Someone who finds the link in a forwarded message, an old email, or over your shoulder cannot use it.

Link previews. This is the underrated one. When you paste a normal short link into WhatsApp, Slack, X or LinkedIn, their crawler follows it and builds a preview card from the destination — title, description, image. With a password set, the crawler hits the password page instead, so the group chat learns nothing.

Bulk scanning. Automated tools that walk short codes looking for interesting destinations find a form.

What it does not stop

The person who enters the password correctly now has the destination URL in their address bar. They can share that URL directly, and it has no password on it, because the password lives on the redirect and not on the file.

If the content itself must not leak, the protection has to be on the destination: a signed URL that expires, an account on the system holding the file, or a document platform with its own permissions. A link password is a lock on the corridor, not on the room.

How ours behaves, precisely

The password is set in the Password section of the link editor and is available from the Pro plan. Four characters minimum, 128 maximum.

On the server it is stored as a bcrypt hash. No API returns it; a link's data carries only a flag saying whether a password exists. There is no recovery flow because there is nothing to recover — if you forget it, set a new one.

The visitor's side is one server-rendered page with a form and no JavaScript. A wrong answer returns HTTP 401 with the same page and a short message. Attempts are rate limited per network address at ten in ten minutes; over that, the page comes back with a Retry-After.

A correct answer redirects immediately, and the click is counted exactly as any other click, with the same country, device and referrer data.

1. 1

   Create or open the link

   Any link can gain a password later, including one already in circulation. Adding one takes effect within about a second, because editing a link clears its cache entry.

2. 2

   Set a password you can say on the phone

   People will receive it separately from the link — in a different message, in a caption, out loud. Two or three words are better than a random string nobody can dictate.

3. 3

   Send the password by a different route than the link

   A link and its password in the same message is a link with a decoration on it.

4. 4

   Check what the preview looks like

   Paste the link into a chat you control. You should see no preview card at all — that is the gate working.

Where it is genuinely the right tool

Pricing that you share with one client at a time, where you would rather it did not circulate. A recording of an internal talk that is not secret but is not for everyone. An early-access page during a launch. A document you send to a journalist with an embargo. A booking page for a private event.

The common thread is content where leaking would be embarrassing rather than catastrophic, and where the audience is small enough that a shared password is a reasonable thing to ask of them.

Combine it with expiry, not instead of it

The strongest simple configuration on a link is a password plus a date plus a click cap. The password keeps out the people who should not have it, the date bounds how long the exposure lasts, and the cap catches the case where the link was shared far more widely than you expected — the link stops before you have noticed anything is wrong.

All three sit in the same editor panel, they take about twenty seconds to set, and unlike the destination's own permissions they can be changed after the link has been sent.