Paste your link, open Advanced options, and type a password. Anyone who opens the short link is asked for it first. The password is stored as a bcrypt hash, so nobody at URLVanish can read it — and nobody can recover it for you either.
How to set a password on a link
-
Paste the address
Any
http://orhttps://address. Use the box at the top of this page. -
Open “Advanced options”
Collapsed by default, just under the input.
-
Type a password
Four characters minimum. Choose something you can pass on separately from the link itself — sending both in the same message defeats the purpose.
-
Share the link and the password separately
Link by email, password by text. Or link in the group chat, password to one person directly.
What the visitor sees
They get a plain prompt asking for the password. No account, no sign up, no email — just the box. Enter it correctly and they go straight to the destination.
Wrong guesses are throttled per IP address, so the password cannot be brute-forced by a script. Failed attempts also never count as a click, which matters if the link also has a click limit — someone guessing wrong cannot burn through a single-use link.
How the password is stored
As a bcrypt hash, the same way a login password should be. That has two consequences worth understanding before you rely on it:
Nobody can read it
Not us, and not anyone who obtained a copy of the database. Only a correct guess verifies against the hash.
Nobody can recover it
There is no reset and no support route. If you forget the password, the link is unusable — create a new one.
When a password is the right control
- The link will sit somewhere semi-public. A group chat, a shared mailbox, a ticket thread — places where the message persists and the audience is wider than you intended.
- You are sending through a platform that fetches links. Preview bots cannot answer a password prompt, so a password is the reliable way to stop automated access. This is why a password beats a one-time limit when the link travels through chat apps.
- You want a shared secret rather than named accounts. One password, handed to a group, no sign-ups.
- The link might be forwarded. Forwarding the link alone achieves nothing without the password.
What it does not do
This is access control on the link, not encryption of the destination.
Anyone who already knows the original address can still reach it directly — the password guards the short link, not the page. And once someone has been through the prompt, nothing stops them saving or sharing what they found. Use it to stop casual or accidental access; do not use it as the only thing standing between a determined party and something sensitive.
Frequently asked questions
Can you tell me the password on a link I made?
No. It is stored hashed, so it cannot be read back by anyone including us. Create a replacement link instead.
Does the + preview give away the destination?
No. For a password-protected link the preview deliberately withholds the destination — showing it would make the password meaningless. It only confirms the link exists and is protected.
How long can the password be?
Between 4 and 200 characters. Longer is better, and it does not have to be memorable if you are pasting it.
Can I combine it with an expiry or a click limit?
Yes, and the combination is stronger than either alone. See self-destructing links and temporary links.
Is a password-protected link private from URLVanish?
The password is, because it is hashed. The destination is not — we have to store it to be able to redirect to it.
Can I change the password later?
Not on an existing link. Create a new link with the new password and share that.