Password-protected short links — when they're worth the friction
Password links annoy everyone. Sometimes that's still cheaper than a leaked staging URL.
Password-protected links are annoying and I won't pretend otherwise. URL in one message, password in another, half the Slack thread asks for the password in replies, someone posts the password publicly "to help" and defeats the point. Everyone knows this dance.
Still useful sometimes. Rarely. But sometimes.
A designer sent us a staging site before launch — three people needed access, not the whole internet. Short link plus password preview2026 was easier to revoke than a signed S3 URL that expired in ways nobody tracked on a spreadsheet. When the site shipped we deleted the link. Done. No ghost preview URLs floating around.
Internal handbook, volunteer schedule, PTA PDF. Not classified, just not for Google indexing. Password is a speed bump, not a vault. noindex on the actual page helps too if you control it.
Won't stop someone screenshotting link and password together. Won't pass compliance audits. Don't password-protect a sale landing page unless you enjoy losing money — I say this with love to the nonprofit that password-protected their donation form in 2024.
Phone-friendly passwords: friday not Fri#2026! when someone's on LTE in a hallway trying to open a doc before a meeting. Say "all lowercase" in the same message as the link. People will thank you.
MyURL lets you set a password when shortening or via API after signup. Visitor gets a simple form then redirect. Not Fort Knox. Semi-private shares for people who already have the context.
If you're just nervous about public URLs, unlisted long links leak the same way — anyone with the string gets in. Match friction to actual risk. Most of the time a normal short link is enough.