How to Password-Protect a Link
(Without Building a Login Page)

What does a password-protected link actually do?

A password-protected link is a short URL that shows a passcode entry screen before it redirects anywhere. The original destination stays hidden until the visitor enters the correct code. No account required on their end — just the code.

It's useful for:

• Sharing early-access content with a specific audience
• Distributing internal documents without setting up a whole access-control system
• Protecting a download link you're sending in a newsletter
• Gating a resource behind a code you give out at an event

How to create one with Brevly

1. Create a free Brevly account — or log in if you have one. Password-protected links require the Secure plan.
2. Paste your destination URL in the link shortener and click "Shorten."
3. Open the link settings and toggle on "Password protection." Enter a passcode — anything from a simple word to a random string.
4. Copy the short link and share it. Anyone who clicks it will see a passcode screen before being redirected.

What the recipient sees

When someone clicks a password-protected Brevly link, they land on a clean unlock page hosted at brevly.link/unlock/[slug]. They enter the passcode, and if it matches, they're immediately redirected to the original URL. The whole interaction takes under five seconds.

The recipient doesn't need a Brevly account. They don't need to sign in anywhere. They just need the code.

Security considerations

A passcode-protected link is not end-to-end encryption. The protection is at the redirect layer — the passcode prevents casual visitors from reaching the destination, but it's not a substitute for proper access controls on the destination itself (e.g., a Google Drive file set to "anyone with the link").

For most use cases — early access drops, gated resources, internal distribution — it's more than sufficient. For truly sensitive data, pair it with access controls at the source.

Link expiry + passwords: the combo

Brevly also lets you set an expiry date on any link. Combining a passcode with a 7-day expiry is a clean pattern for time-limited access — the link stops working after the window closes, regardless of whether the passcode is shared.