How a password-protected link works
When someone opens a protected short link, urlf.ly does not redirect them straight away. They see a page that says This link is protected with a single password box. The destination address is not shown on that page.
If the password is right, the visitor is sent on to the destination as usual. If it is wrong, they see Wrong password. Try again. and stay on the prompt. To slow down guessing, each visitor gets 10 tries per link every 10 minutes; after that they have to wait.
Once a visitor has entered the right password, their browser stays unlocked for that link for 60 minutes, so opening it again in that window does not ask a second time.
The password itself is never stored in readable form. urlf.ly keeps only a one-way hash, the same way account passwords are stored, which is why nobody can look it up later, including you.
How to password protect a link on urlf.ly
- Sign in to your account and open the dashboard.
- Paste the long URL into Destination URL. Add a title or custom alias if you like.
- Open Advanced options and type a password into the Password field. It must be 4 to 72 characters.
- Press Create link. The new short link now asks for the password before it redirects.
- Share the short link and the password through different channels, for example the link in an email and the password in a text message.
To change the password later, open the link’s Edit page and type a new one. To make the link public again, tick Remove password and save.
Good uses for a password-protected short link
- Client previews. Share a staging site, a draft document, or a design file with one client without posting an open link.
- Event material. Give attendees one short link for slides or recordings and announce the password in the room.
- Team links in public places. Post a short link in a shared channel or a printed handout while keeping casual visitors out.
- Course or member downloads. Hand out a single link that only people with the password can follow.
What password protection does not do
The password guards the short link, not the page it points to. Anyone who already has the full destination URL can open it directly, so do not rely on this for truly secret content. For that, protect the destination itself as well.
A link has one password that everyone shares. There are no per-person passwords or access lists, and you cannot see who typed the password. Clicks still show up in your link statistics like any other visit.
Password protection is part of the paid plan. You can upgrade from your dashboard. If your account later moves to a plan that does not include password links, the link keeps working but stops asking for the password.
Frequently asked questions
Can I see the password of a link later?
No. Only a one-way hash of the password is stored, so it cannot be shown again. If you forget it, open the link’s Edit page and set a new password.
Does the password protect the destination page too?
No. It protects the short link only. Someone who already knows the full destination URL can still open it directly.
How long does a visitor stay unlocked?
After the right password is entered, that browser can open the link again without the password for 60 minutes.
What happens after too many wrong passwords?
Each visitor gets 10 tries per link every 10 minutes. After that they must wait before trying again.
Can I remove the password later?
Yes. Open the link’s Edit page, tick Remove password, and save. The link then redirects normally again.