To password protect an HTML page properly, the server must refuse to send the page until the right password is given. On HTMLtoLink, open Password protect this link before publishing and type a password — visitors see a password screen and the HTML is never sent until they enter it. A password checked by JavaScript inside the page is not protection: the content is already in the page source.
Why JavaScript password prompts do not work
A common snippet does if (prompt('Password') !== 'secret') location = 'about:blank'. The problem is that the browser has already downloaded the whole page, including the "secret" and the content, before the script runs. Anyone can press Ctrl+U to view the source, disable JavaScript, or read the password straight out of the code. It stops nobody who is curious.
How server-side protection works
- The visitor opens the link and the server sees there is no valid access cookie.
- It returns a small password form instead of your page. Your HTML, CSS and images are not sent.
- The visitor submits the password. The server checks it against a salted hash (we never store the password itself).
- If it matches, the server sets a cookie for that page only, and serves the files — for 30 days on that browser.
Add a password on HTMLtoLink
- Paste or upload your HTML on the publisher.
- Open Password protect this link and type a password.
- Publish, then send the link and the password separately — for example the link by email and the password by text message.
To change or remove the password later, use Update content from My links.
Paste code or drop a file, ZIP or folder. Free plan with Google sign-in, custom address & password. Get a link
Choosing the password
- Use at least three random words or 10+ characters; it only has to be typed once per device.
- Do not reuse a password from another account.
- For a group (a class, a client team), one shared password is fine — change it when the group changes.
What a password does not do
Anyone who knows the password can copy what they see, and a password-protected page cannot show a link-preview image in chat apps (the app does not know the password). For truly sensitive data — medical, financial, personal records — use a system with individual accounts and audit logs, not a shared page.