How to password-protect an HTML page
A password written into the page’s own JavaScript can be read by anyone who opens the source. The password has to be checked by the server before the page is sent.
Search for a way to password-protect an HTML page and the first answers are often a snippet of JavaScript: a prompt asks for a password, compares it with a value in the script, and shows the page if they match. It looks like protection. It is not, because the browser has already downloaded the whole page, password included, before the prompt appears.
Why a JavaScript password does not protect anything
Everything in an HTML file is sent to the visitor’s browser. View source, the browser’s developer tools, or turning JavaScript off shows the content and the password the script compares against. Hiding the content with CSS or encoding the password changes nothing: the decoding step is in the same file.
The rule that follows: the check has to happen on the server, and the server must not send the page until the password is right.
Options that check on the server
- ✓Your own Apache or Nginx server: HTTP basic authentication (an .htaccess and .htpasswd pair on Apache, auth_basic on Nginx). It works, but you run and patch the server, and visitors get the browser’s plain sign-in box.
- ✓A static host with password protection built in. GitHub Pages has no password option for public sites; some other hosts offer one on paid plans.
- ✓FileShare Pro: upload the .html file and add a password to its link in the Share dialog (Pro plan).
How the FileShare Pro password works
Open the file’s Share dialog and choose “Require a password to open the link”. From then on, a visitor who opens the link sees a password page; the HTML itself is not sent.
When the visitor types the right password, the server checks it and gives that browser an access key good for 12 hours, so they are not asked again on every visit. Password attempts are limited to ten a minute per network, which makes guessing slow. A password-protected page is never cached. The password is stored as a salted hash, not as plain text.
You and the people you have added to the file by email do not need the password; they are let in by signing in. The password is for everyone else you hand the link to.
Combine it with an expiry date or a people list
A password is one of three ways to control a link. You can also set the link to expire on a date, after which it returns “Link expired” instead of the page, or turn the link off and share the file only with named people by email. Every shared page is also sent with a noindex tag, so search engines do not list it: sharing a preview without Google finding it covers that part.
To change the page later, upload the new version over the old file. The link and its password stay the same. Updating a shared link without changing it has the details.
Frequently asked
Not securely. The browser downloads the whole file, including the password the script checks, before the prompt runs. Anyone can read it with view source.
No. They type the password on the page. People you added to the file by email can sign in instead.
The browser gets an access key that lasts 12 hours. After that the visitor types the password again.
Yes. The Share dialog has a Remove button; remove it and set a new one to change it. The link itself does not change.
Password-protected links are on Pro. The free plan hosts up to 50 files with comments, link expiry and noindex included.
Drop the file, copy the link — live in seconds, free plan included.
Start sharing free