How to password protect an HTML page (without a server)
To password protect an HTML page without running a server, use a host that checks the password for you, or encrypt the file with StatiCrypt. Never put the password in the page's JavaScript. ArtifactSend checks passwords on its server for free, and can ask for a verified email instead.
How can I password protect HTML pages?
There are three good ways. Each keeps the password out of the page.
- A host with a password. Netlify has it on Pro, Vercel on Pro at $20 a month per protected project, and Tiiny Host on Solo and above.
- An encrypted file. StatiCrypt encrypts the page with AES-256. The visitor types the password and the browser decrypts it. It is free and open source.
- A private link. Drop the page into ArtifactSend and add a password under More settings. It is free, and you see who opened it.
How can I password-protect HTML securely without exposing the password in JavaScript?
Check it on a server, or encrypt the content with it. A script that compares what the visitor typed with a password in the page gives the password away to anyone who views the source.
ArtifactSend checks the password on the server and stores only a scrypt hash. The page is not sent until the reader passes. StatiCrypt never stores the password, but the encrypted file is public. Its author warns that guessing attacks are fast, and suggests at least 16 characters.
Can I restrict access to people with a secret link without a password?
Yes, but a secret link is only as private as the people who hold it. GitHub says this plainly about secret gists. They are not private, and anyone who finds the address can see them.
A better choice than a secret link is an email check. On ArtifactSend, readers type an email, prove it with a 6-digit code or Google sign-in, and must be on your allow list. A separate link for each person can be set to open only for their email.
How do I prevent search engines from indexing a privately shared page?
Use a noindex tag, and put the page behind a door. Google says a noindex rule keeps a page out of its results. A robots.txt block alone does not, because Google can still list an address it finds elsewhere.
ArtifactSend marks every shared page noindex and blocks shared links in its robots.txt. Behind a door, there is nothing for a crawler to read. In July 2026 TechCrunch reported that shared Claude chats and artifacts showed up on Google after people posted their links in public.
Password, email code or both?
| Door | Proves who the reader is | Can be forwarded | Names the reader in your report |
|---|---|---|---|
| Password | No | Yes, with the link | No |
| Typed email | No, but fake and throwaway emails are refused | Yes | Yes |
| Email code or Google sign-in | Yes | No | Yes |
| Email code with an allow list | Yes, and only listed people | No | Yes |
Publish from your agent
To publish from an agent, connect the ArtifactSend MCP server at https://artifactsend.com/mcp, or run npx artifactsend setup. Every tool, setup step and limit is on artifactsend.com/agents.