Put a password in front of any short link
Share a link in public and still decide who gets through it. ClikSo checks the password at the edge before the redirect happens, and stores it AES-256-GCM encrypted.
Starter and above · No credit card required
This link is protected
Enter the password to continue
Quick answer
What is a password-protected link?
A password-protected link is a short link that asks for a password before it redirects. ClikSo shows an unlock page, checks the password against an AES-256-GCM encrypted value, then sends the visitor on to the destination. Because the destination is resolved server-side, the URL cannot be read from the link itself — only people with the password ever see where it goes.
- How every link password is encrypted at rest
- AES-256-GCMHow every link password is encrypted at rest
- How long a visitor stays unlocked after entering it
- 1 hourHow long a visitor stays unlocked after entering it
- Cheapest ClikSo plan that includes it
- $4.99/moCheapest ClikSo plan that includes it
- Bitly offers no password protection on any plan
- Not on BitlyBitly offers no password protection on any plan
- Available from the Starter plan ($4.99/month billed yearly)
- A visitor stays unlocked for one hour, then is asked again
- Bitly offers no password protection on any plan; Rebrandly and Short.io gate it behind higher tiers
How to password protect a link
Four steps, and none of them involve changing anything on the destination site.
Create or open a link
Paste your destination URL into ClikSo, or open a link you have already shared. Password protection can be added to an existing link without changing its slug, so anything already printed or posted keeps working.
Set a password
Open the link’s security settings and type the password you want to hand out. It is encrypted before it is stored, so the plaintext never sits in the database.
Share the link and the password separately
Send the short link the usual way, and give the password over a different channel. The destination URL is never part of the short link, so the link on its own reveals nothing.
Visitors unlock, then continue
Anyone opening the link gets an unlock page instead of the redirect. Once they enter the right password they are sent straight on to the destination, and a signed cookie keeps them unlocked for an hour so they are not asked again on every click.
What the database actually stores
Rebrandly and Short.io both offer password protection. Neither publishes this part.
The password you set
summer-2026
What is written to the row
v1.<iv>.<ct>
v1
Key version
Stored alongside the value, so the encryption key can be replaced without invalidating a single existing link.
<iv>
Initialisation vector
Generated fresh for every password, so the same password never produces the same stored value twice.
<ct>
Ciphertext
The encrypted password and its authentication tag. The plaintext is never written to the row.
What people use it for
Any time the link has to travel further than the audience for it.
Client deliverables
Send a proposal, a design review or a report to one client without it being forwardable to the next. The link can go in an email; the password can go over the phone.
Internal-only announcements
Share an internal doc, a runbook or a staging environment in a channel where you cannot fully control who is watching, and gate it with a password the team already has.
Paid or members-only content
Hand paying members a link to a download, a recording or a private stream, and give the password only to people who have actually bought it.
Deals and diligence
Circulate a data-room index or a pricing sheet during a negotiation where a forwarded URL is a real problem, and rotate the password when the round of conversations moves on.
Course and cohort material
Give a cohort one link per module. The same link works all term, and the password keeps it inside the cohort rather than loose on the open web.
Anything you will want to revoke
Because the destination is stored on our side rather than encoded in the link, you can change the password, re-point the link, or set it to expire later — without reissuing the URL.
Password protection across link shorteners
The row that usually decides it: Bitly does not offer this at any price.
| Capability | ClikSo | Bitly | Rebrandly | Short.io |
|---|---|---|---|---|
| Password-protected links at all | ||||
| Cheapest plan that includes it | $4.99/mo | Not available | $29/mo | $24/mo |
| Publishes how passwords are stored | AES-256-GCM | |||
| Password can be added to an existing link | ||||
| Combine with an expiry date |
Competitor details taken from each provider's own published pricing and documentation, last verified 16 September 2026.
Good to know
- Password protection starts on the Starter plan. The Free plan can create links, use custom domains and see analytics, but cannot gate a link with a password.
- A password is not a substitute for authentication. Anyone who has both the link and the password can open it, and can pass both on — use it to raise the bar on casual sharing, not to protect regulated data.
- Unlock attempts are not currently rate-limited at the edge, so choose a password with real entropy rather than a short memorable one.
- The one-hour unlock is per browser. Someone opening the same link on their phone will be asked again.
Password protection by plan
Password protection starts on Starter. It combines on a single link with link expiration, which is free on every plan — so the Free plan can give a link an end date, and Starter adds the password in front of it.
Frequently asked questions
Create a short link in ClikSo, open its security settings, and set a password. Anyone who opens the link then sees an unlock page and has to enter that password before they reach the destination. You can add a password to a link you have already shared without changing its URL.
Encrypted with AES-256-GCM before it is written to the database, using a key held outside the application. The stored value is versioned, which means the key can be rotated without invalidating existing links. The plaintext password is never stored.
No. The destination is resolved on our side after the password is accepted, so it is not encoded in the short link and does not appear in the page source of the unlock screen. A person who has the link but not the password cannot tell where it leads.
No. Once a visitor unlocks a link, a signed cookie keeps that link unlocked in their browser for one hour. After that it asks again.
No. Bitly does not offer password protection on any of its plans, including its paid tiers. ClikSo includes it from the Starter plan, and every link password is stored AES-256-GCM encrypted.
Password protection is available from the Starter plan, which is $4.99 per month billed yearly or $6.99 billed monthly. It is not included on the Free plan.
Yes. Both are per-link settings and they work together — the link asks for a password until its expiry date passes, after which it stops resolving and can send visitors to a URL you choose instead. Link expiration is free on every plan; the password is the half that needs Starter.
No. Self-destructing link tools are built for sharing a secret once and destroying it. A ClikSo password-protected link is a normal short link you can reuse, track and re-point, with an unlock step in front of it.
Related features
Or see everything in the full feature list.
Link expiration
Give a link an end date — and decide where visitors go once it has passed, instead of a dead page.
On every plan, including FreeTeam workspaces
Shared link libraries with admin, editor and viewer roles — so the intern cannot re-point your campaign.
On every plan, including FreeCustom domains
Put your own brand on every short link. One custom domain is included free, with SSL issued automatically.
On every plan, including FreeLast reviewed 16 September 2026 against the live product. Competitor details come from each provider's own published pricing. See the full feature list or ClikSo vs Bitly.
Ready to get started?
Join the marketers and developers building the future of link sharing.
Free forever plan. No credit card required.