Product
Password-protected links: share a URL, not access to it
Sometimes a link needs to travel through a public channel — a group chat, a printed handout, a public post — without the destination being public. A password on the short link puts a door in front of it.
How it works#
When a protected link is opened, Xlyl shows a password prompt instead of redirecting. The visitor types the password; if it matches, they are sent to the destination and the click is counted. If not, they are told the password is wrong and nothing about the destination is revealed — not the URL, not the title, not a preview.
The password is hashed with bcrypt before it is stored, so a copy of the database does not expose it. Because of that, it cannot be shown to you again: if it is forgotten, set a new one.
Creating a protected link#
Sign in and open advanced options#
On the homepage, tick “Show advanced options”. Protection needs an account so the password can be managed later.
Set the password#
Fill in the Password field alongside the URL, then shorten. Add a custom alias if people will type the link, and consider an expiry if the share is temporary.
What it is for — and what it is not#
Protected links suit previews, drafts, event materials, internal documents shared via public tools, and anything with a small audience and a public route to it. Every visitor uses the same password, so this is access control for a group, not per-person authentication: it cannot tell you who got through, only that someone with the password did.
It also does not protect the destination itself. Once through, the visitor has the real URL and can share it. If the destination must stay private, protect it at the destination as well.
Frequently asked questions#
How do I password-protect a link?#
Sign in, open advanced options on the homepage, and type a password in the Password field before shortening. Anyone opening the short link is asked for it before being redirected.
Is the password stored securely?#
Passwords are hashed with bcrypt before they are stored, the same way account passwords are. The plaintext is never kept and cannot be recovered — not even by the link owner.
Can I add or remove a password on an existing link?#
Yes. Edit the link from your dashboard: set a new password to add or change it, or clear the field to remove it.
Does a password-protected link still count clicks?#
Yes. A click is recorded when the correct password is entered and the visitor is redirected, so statistics reflect people who actually got through.