# How to password-protect an HTML page

Why a password in JavaScript protects nothing, how to have the host check it before the page is sent, and when a sign-in rule is the better choice.

Source: https://publidock.com/blog/password-protect-html-page

Published: 2026-10-26
Topic: Sharing

You want a client to see a page, and nobody else. The quickest idea is a password. How you add it decides whether it protects anything.

## A password in JavaScript protects nothing

Many snippets online check a password in the page's own JavaScript: a prompt, a comparison, and the content revealed if it matches. The content is already in the browser. Anyone can open the page source, read the password or skip the check, and see everything.

Encrypting the page in the browser is better, but the protection is only as strong as the password, and the encrypted page can be copied and attacked at leisure.

A password has to be checked **before** the page is sent. That means the server holding the files must do it.

## Ask the host to check it

Hosts that serve static files often offer this as a setting, usually on paid plans. On Publidock, a password link is one of the four sharing rules, on Solo and above:

1. Publish the file, folder or zip.
2. Under **Who can open it**, choose **Password protected** and set the password.
3. Optionally set an expiry, so the link stops working after the review.
4. Preview, then go live.

Visitors see a password prompt. Publidock checks it on the server and only then sends the page, and repeated wrong guesses are slowed down.

## When a password is the wrong tool

A password works for anyone who has it, and it can be forwarded with the link. It says nothing about who is opening the page.

- For **people at your company**, use the company-domain rule. Viewers sign in with their Google or Microsoft work account.
- For **a few specific people**, use named people. Only those email addresses get in, and you can remove someone without changing the link.

Both are on Team. The [access guide](/blog/restrict-access-to-published-html) shows how to test each rule as a recipient.

## Check before you send it

Open the link in a private window. You should see the prompt, not the page. Enter a wrong password, then the right one. If the page loads but images or styles are missing, the [missing assets guide](/blog/fix-missing-images-and-css-in-html-uploads) explains why.

Published sites are kept out of search engines, but that is not access control. The password, or a sign-in rule, is what keeps the page private. More on the options: [sharing and access](/product/sharing).

## Related

- [Sharing & access](https://publidock.com/product/sharing/index.md)
- [Publidock vs Tiiny Host](https://publidock.com/compare/tiiny-host/index.md)