Protecting Links and Files with Passwords

TinyX lets you add a password to any link, including links that share a file, an Upload Drop or a questionnaire. Visitors see a password prompt before they can reach anything. They don't need an account. Password protection is available on every plan, including Free.

Adding a password to a link

1. Click Create Link (or open an existing link and click Edit Link)
2. Fill in Password Protection
3. Save the link

When someone opens your short link, they see a password screen first. They aren't redirected, and they don't see the destination, until they enter the correct password. Once entered, the password is remembered in that browser for about an hour.

Sharing a file with a password

Passwords live on the link, not on the file itself. To protect a file, create a link to it on the File tab and set a password on that link. Anyone you share the link with needs the password to view or download the file.

Tips

Sharing the password: TinyX doesn't send the password to anyone. Share it separately through a different channel (a text message, a call, in person).

Changing a password: You can change or remove the password on a standard link at any time from its edit screen. Visits and downloads that already happened aren't affected.

End-to-end encrypted links are the exception. On an end-to-end encrypted link the password is the encryption key, so it is set once when you create the link and can't be added, changed or removed afterward.

Forgotten passwords: TinyX stores passwords only as salted hashes (PBKDF2-SHA256, 100,000 iterations), so we can't tell you what a password was. On a standard link, just set a new one. On an end-to-end encrypted link a lost password can't be recovered, and neither can the file.

Attempts are logged: password attempts show up in the link's access log, so you can spot repeated failures.

Common questions

Why isn't my link working for someone? Check whether the link has a password. They may have mistyped it or not realized one was needed. Also check whether it has expired or hit its limit.

Can a visitor see the destination URL before entering the password? No. The redirect only happens after a successful password check.