Short answer
A shared HTML link on HTMLtoLink is unlisted: it is not linked from anywhere, search engines are told not to index it (noindex), and it expires on the date you choose. But anyone who has the link can open it and forward it. For anything you would not want forwarded, add a password; for genuinely sensitive data, do not put it in a shared page at all.
What protects your page
| Protection | Stops | Does not stop |
|---|---|---|
| noindex header (on every page) | Appearing in Google, Bing and search-based AI answers | People who already have the link |
| Unlisted address | Discovery by browsing — nothing links to it | Guessing an obvious custom address like test |
| Random address (default) | Guessing | Forwarding |
| Password | Forwarded links, guesses, crawlers | People who are told the password |
| Expiry | Old links living forever | Copies people saved before it expired |
The leaks people do not expect
- Link previews. When you paste a link into Slack, WhatsApp or iMessage, the app fetches the page to build a preview. That is a robot reading it — harmless for the noindex rule, but it means the title and description are shown to everyone in the chat.
- The page source. Everything in your HTML and JavaScript — comments, hidden elements, API keys, email addresses — is readable by anyone who opens the page. "Hidden with CSS" is not hidden.
- Forwarding and screenshots. No technology prevents someone you sent it to from passing it on.
- Guessable custom addresses. A random address like
calm-otter-4821is effectively unguessable;testorquizis not. Use the random one, or add a password.
Checklist before sharing
- Search the code for
key,token,secret,passwordand email addresses. - Remove comments meant for you (the minifier strips them).
- Decide: public link, random link, or password.
- Pick the shortest expiry that works, and delete the link when you are done.
What HTMLtoLink does and does not see
We store the files you publish so we can serve them, and delete them when the link expires or you delete it. We add no analytics or tracking cookies to published pages. Reported pages may be reviewed for abuse. Details are in the privacy policy.