Password Protect a Link: How Protected Short Links Work

Password-protect a short link on any SendURL plan, Free included: turn on Password protect when you create the link, and visitors must type the password before they're redirected. It's a simple gate for links meant for some people, not everyone who sees the URL: a preview for a client, slides for workshop attendees, a download for members.

Elsewhere it's usually a paid feature: as of 15 October 2026, the pricing pages of Short.io and Dub put it on their Pro plans, and Rebrandly's on Professional.

What visitors see

When someone opens a protected link, or scans its QR code, they get a page that says "This link is protected", with the short link underneath and a password field. They type the password and choose Continue.

• The right password sends them straight to the destination, and the click is recorded.
• A wrong one shows "That password isn't right. Try again."
• Submitting without a password asks for one.

Opening the password page doesn't count as a click. Only visitors who get through are counted, so your analytics show real visits, not people who gave up at the prompt.

Wrong guesses are rate limited

To stop someone from guessing their way in, SendURL counts attempts per link and per visitor. After 10 attempts on a link from the same IP address within 15 minutes (for IPv6, from the same /64 network), the page stops accepting passwords and shows "Too many attempts", with the number of minutes to wait. Because one IPv6 network can spread across many smaller ones, there is also a wider limit of 50 attempts per link for each IPv6 /48. Typing the right password gives its attempt back, so people who know the password aren't locked out by their own visits.

The page also refuses passwords sent from other websites, so another site can't make a visitor's browser guess on its behalf.

How to add a password

When you create a link:

1. 1.
   In the console, choose Create link.
2. 2.
   Paste the Destination URL.
3. 3.
   Turn on Password protect and type the password. The rules are shown with the field: 6 to 128 characters, no space at the start or end.
4. 4.
   Choose Create short link.

To change an existing link, open its page and use the Password card. Set password adds one, Change password replaces it, and Remove password opens the link to everyone again after you confirm. The card also lets you reveal or copy the current password, which is handy when someone asks for it again.

With the API, send password when creating a link or in PATCH /links/:id, and null to remove it:

curl -X PATCH https://api.sendurl.to/api/v1/links/LINK_ID \
  -H "Authorization: Bearer $SENDURL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"password": "harbor-lights-42"}'

API responses never include the password itself, only passwordProtected. Only you, signed in to the console, can see it.

Rules and limits

• 6 to 128 characters, with no whitespace at the start or end
• The destination must be an http or https URL, so links to other schemes, such as mailto:, can't be protected
• Guest links from the home page can't have a password; claim the link first
• A disabled or expired link shows its own page whatever the password; see Link expiry and visit limits

What a password does and doesn't protect

A password protects the short link. It does not protect the destination. Anyone who gets the destination URL some other way, for example because a visitor forwards it after getting through, can open it directly. If the content itself must stay private, protect it where it lives as well, with the sharing settings of the service that hosts it.

SendURL stores link passwords so that you can see and copy them in the console. Treat a link password as a share code, not as an account password: make up a new one for each link, and never reuse a password you use anywhere else.

Good uses

• Previews and drafts for a client or a reviewer
• Course or workshop materials handed out in a room
• Early access links for a waitlist
• Internal documents shared in a group chat

On printed material, a password keeps a QR code useful only to the people you've told it to, such as staff or event attendees, while the code itself can sit in plain view.

Changing or removing a password later

A new password takes effect within seconds. Anyone who had the old one needs the new one from then on; nothing else about the link changes, including its slug, QR code and click history. Removing the password opens the link to everyone straight away. For the other ways to restrict a link, see Disable a short link without deleting it.