Sometimes a short link needs to travel through email, threads and screenshots before it reaches the right person. Password protection makes sure only the right person gets through, and the rest hit a polite wall.
Toggle it on inside the link editor. Picolink hashes the password, drops in a branded unlock page, and hands the visitor through to your destination once they're in.
Type your own, or hit Generate for a short, pronounceable code like bafe-tomi-keru, built from random bytes in your browser. Minimum four characters, hashed the moment you save.
Send the short URL anywhere: Slack, email, a deck, a print ad. Send the password through a private channel the way you already trust.
Once they're in, the device remembers them for as long as you allow. Wrong password? They get a soft retry, then a cool-down. Never a brute-force door.
A simple password field hides a lot. Here is exactly what is happening on our side, and what isn't.
The instant you save, your password is hashed with bcrypt at cost factor 12 and dropped. Even with full database access we can't tell you what it was. We just verify what visitors type.
Forwarded to the wrong room? Change the password and every existing "remember me" cookie is invalidated on the next click. No waiting, no hunting people down.
Configurable on every single link.
10 failed tries inside fifteen minutes trip a fifteen-minute cool-down, scoped to one IP on one link, so a noisy attacker can't lock out real visitors. No captcha noise, no telling attackers when they got close.
Add a private nudge for legitimate viewers without ever showing the answer.
Attempts, hints and unlock cookies stay in the auth path. Your analytics dashboard only sees clean, post-unlock clicks.
Customers tell us they use password protection for the boring "we don't want this Googled" moments, but also for the fun ones. A sampler:
Send the proposal short link to a client. Share the password by phone. No accidental forwards to procurement.
Compensation bands, post-mortems, all-hands recordings. Same easy short URL, only readable by people you actually told.
One short URL, one rotating password. Hand it out in your launch email. Rotate it the day the public beta opens.
Hide a teaser behind a password mentioned at a meetup. Watch your analytics for the moment it leaks, then rotate.
Available on every plan, including the free one. No add-on, no upsell, just a toggle in the link editor.