How to password-protect a file or link (and why you should)

You send a client a link to their draft report. They forward the email to a colleague, who pastes the link into a team chat, where someone from another company is a guest. Nobody did anything wrong, and the report is now open to people you have never met.

That is how most links behave. Whoever holds the URL can open it, for as long as it works. A password doesn't make the link secret, but it means the URL on its own is no longer enough.

How to password-protect a file or link

The pattern is the same whichever tool you use. You put the file or link behind a page that asks for a password, and you send the password separately from the link.

In TinyX it takes three steps. Create a short link, upload a file, or build a gallery, questionnaire or upload link. Turn on password protection and type the password. Then set an expiry date if you want the link to stop working later.

Send the link by email and the password by text or phone. If both travel in the same email, anyone who gets the email gets both.

Password protection is on every plan, including Free. You can see what each plan includes on the pricing page.

What a password actually protects

A password stops anyone who has the link but not the password. That covers forwarded emails, links pasted into the wrong chat and links that turn up in a browser history on a shared computer.

On TinyX, the visitor sees a password page first. The destination URL or file isn't shown until the right password is entered, and each attempt, right or wrong, is recorded in the link's access log.

Link passwords are salted and hashed with PBKDF2-SHA256 (100,000 iterations). We never store them in plain text.

A password doesn't stop someone who has both the link and the password from sharing both. It doesn't make the file encrypted end to end either. That comes with Pro and Max, and it is a different protection, which how TinyX encrypts your files explains.

Why a password works better with an expiry date

A password protects who can open a link. An expiry date protects how long anyone can. Most leaks come from old links nobody remembers, so the two work best together.

On TinyX, any link can expire on a date you choose, on every plan. Short links can also stop after a set number of clicks, galleries and folders after a set number of page opens, and single files after a set number of downloads. A preview counts towards a file's download limit, so a one-download link really is one look.

When either limit is reached, the link shows a "Link Unavailable" page and doesn't redirect anywhere. For files, the file is deleted rather than archived. Your share link from 2021 still works explains why that default matters.

What you can put behind a password in TinyX

The same password protection works across everything you can share from TinyX.

• Short links that point to any web page
• Single files and folders
• Galleries of photos
• Questionnaires, such as an intake or enquiry form
• Upload links, where someone sends files to you (Pro and Max)

A password on a questionnaire is useful when the form is meant for one client, like a law firm intake form. A password on a gallery suits photographers sending a shoot to one couple. The password doesn't change how responses are stored, so questionnaire answers are still not end-to-end encrypted.

Changing a password, or the link, after you have sent it

You can add a password after you've sent the link, on every plan, except on end-to-end encrypted links, where the password is the key.

Plans change and people leave projects. If you change a link's password, anyone who opened it with the old one has to enter the new one next time.

You can also change where a short link points after you have shared it, on every plan. That is handy when a document is updated: the client keeps the same link and password, and it opens the new version.

One link has one password. If you need to know who opened what, give each recipient their own link. Free includes 25 links a month, Pro 1,000 and Max unlimited.

Why not just use Google Drive's link sharing?

Google Drive can restrict a file to named people with Google accounts, and that works well inside one company. The trouble starts with "anyone with the link", which has no password and, as we found, never expires.

If your recipients are outside your organisation and you don't want them to sign in, a password and an expiry date on the link is the simpler control.

Where to start

Pick the next file you were going to attach to an email. Upload it to TinyX on the Free plan, add a password and an expiry date, and send the password by text. It takes about a minute, and it means the link stops being the only key. The features page lists everything else you can put behind a password.