Password-Protected Links

Password-protected links add a verification step before the redirect — giving the link creator control over who can access the destination, without requiring authentication at the destination itself.

---

Definition

A password-protected link is a short URL that does not redirect immediately when clicked. Instead, it presents a password entry form — a simple page hosted by the URL shortener — where the visitor must enter a correct password to complete the redirect. Visitors who enter the wrong password or no password are not redirected to the destination.

The password is set by the link creator at the time of link creation or via the link editing interface. It must be communicated to intended recipients through a channel separate from the link itself — typically in the same email, message or document that contains the link.

How Password-Protected Links Work

1. Link creator sets a password when creating or editing the link in Cuttly
2. Link is shared with intended recipients — along with the password, communicated separately
3. Recipient clicks the link → Cuttly serves a password entry page
4. Recipient enters the correct password → Cuttly completes the redirect to the destination
5. Recipient enters the wrong password → not redirected; error shown on password page

The password entry page is hosted by Cuttly — not by the destination. The destination itself does not need to implement any authentication. This makes password-protected links useful for controlling access to destinations that are themselves publicly accessible but should be selectively shared.

Use Cases

Confidential Document Sharing

Legal agreements, financial reports, internal strategy documents, client proposals — documents hosted on cloud storage (Google Drive, Dropbox, SharePoint) that are accessible to anyone with the link can be wrapped in a password-protected short link. The short link is shared; the password is sent separately. Only recipients with both can access the document.

Member or Client-Only Resources

Member newsletters, client deliverables, subscriber-only content — distributed via password-protected short links provide a lightweight access control layer without requiring the recipient to create an account on a separate platform or for the destination to implement authentication.

Event and Exclusive Access

Early bird registration pages, VIP event booking links, exclusive presale access — gated behind a password-protected short link. The password functions as a simple access token distributed to the intended audience.

Internal Resource Distribution

Teams sharing internal resources via a link in a public channel (a Slack workspace that includes external guests, a shared calendar invite visible to a wide audience) can password-protect the link to restrict access to team members who know the password, even if the link itself is visible to a broader audience.

Limitations

Password-protected links are a lightweight access control mechanism, not a security hardening tool:

• Password sharing. Recipients who know the password can share it with others. If the audience grows beyond the intended scope, the password provides no further barrier.
• Password discovery. Simple or guessable passwords provide minimal protection. Use non-dictionary passwords that are not easily guessed.
• Not a substitute for destination-level authentication. For truly sensitive content requiring strong access control — medical records, financial data, personal information — implement authentication at the destination. Password-protected short links are appropriate for selective sharing of non-critical content, not as the primary security layer for sensitive data.

Availability

Password-protected links are available in Cuttly from the Single plan ($25/month). The password is set per link — different links can have different passwords.

Related Terms

• Link Expiration
• Link Management
• HTTPS & SSL
• Geo / Device Targeting