Protect a link with a password and expiry
Add a password, set an expiry, and understand what each one guards against.
3 min read · Updated July 13, 2026
A share link's address is already unguessable, but for anything sensitive you'll want two extra guards: a password and an expiry date. Both apply to document and collection links alike.
Password
- When set, the recipient must enter the password before anything loads. It's checked securely and never travels in the link itself.
- Send the password through a different channel than the link (a text message, say, not the same email).
- Password-protected links are part of the paid plans.
Expiry
- Pick a future date and the link stops working after it, automatically.
- No expiry means the link lasts until you revoke it.
- Expiry is available on every plan.
Good to know
Wrong-password attempts are rate-limited, so a link can't be brute-forced. And a link stops resolving the instant the document is trashed or you revoke it, whatever its expiry.
Tip
For a one-time hand-off, set a short expiry and revoke the link as soon as it's been used.
Was this article helpful?
Stoatify sends only this article's route and your Yes or No choice.