Password Link vs Public Link: Secure Sharing Guide

The short answer

The choice between a password link and a public link gets harder when the work is important. A public link is easy to open and easy to forward. A password adds a shared secret (a code that a group knows). Verified email access (a one-time code sent to the address of the visitor) adds a step for the visitor. But it tells you which mailbox opened the material.

In short, choose by the material that you send and the information that you need later. Use a public link for material that people can share freely. Use a password for basic privacy. Use verified email when you need to know who opened the material or when you must stop forwarding.

This guide covers these topics:

• How each access mode handles forwarding and visitor identity
• What the activity data can and cannot tell you under each mode
• Which real tools offer each mode for websites and for documents
• How to share and update client work with no accounts for recipients

Password link vs public link: the core difference

Each mode asks the visitor for a different proof. A public link needs only the URL. A password link also needs the shared secret. A verified email link needs a one-time code that the service sends to an approved address.

Factor	Public link	Shared-password link	Verified email link
Visitor friction (extra steps)	Very low	Low to medium	Medium
What people can forward	The URL	The URL and password	The URL, but the new visitor still needs an approved inbox
Identity evidence	Little or none	Shows knowledge of the password	Shows control of the verified inbox at access time
Activity data	Counts and sessions	Protected sessions, usually without a reliable identity	Activity linked to an email address
Suitable uses	Public resources, portfolios, brochures	Drafts and low-risk client previews	Proposals, data rooms, private reports, sensitive demos

Access control and knowledge of who got in are related, but they are different. A gate can keep casual visitors out and tell you nothing about the people who passed it.

No setting is always best. Choose the least restrictive setting that protects the work and gives you the evidence that you need.

When a public link is the right choice

Public sharing works when reach is more important than identity. Recipients click one time and read, with no code, password or account. Use a public link for material that people can forward to anyone, with no harm to you.

These are good uses for a public link:

• Portfolio samples and public case studies
• Product brochures and press material
• Event decks for wide distribution
• Public guides, media kits and documentation
• Lead magnets with a separate contact form

For example, a freelance designer can send a finished case study to five prospects through a public link. The prospects can send the link to colleagues. This forwarding is useful. It is not a security failure.

The disadvantage is attribution (knowing who did what). You can see visits, referrers or downloads. But usually you cannot say that a named client opened the page. Two people on one office network can look like one visitor. One person on a phone and a laptop can look like two visitors.

Treat a public link as public. A hard-to-guess URL is not a security control. Links go into forwarded email, chat history, browser sync and link previews. Before you share, remove private notes, hidden exports, credentials and unused source files.

What a password-protected link protects, and what it does not

A password adds friction. It stops accidental discovery and crawlers (programs that index web pages). It also shows that the material is not for everyone. This can be enough for an early design concept or a routine client report.

An agency can share a prototype with four people at a client company. The agency sends one URL and one password, and nobody needs an account. But all four people give the same proof: they know the shared secret.

Password access alone does not prove who visited. Many people can enter the password. Examples are the intended recipient, an assistant and a colleague who got the forwarded email. A person who found the password in an old thread can also enter it. Activity data can describe the protected session. But a name on that session is only a guess.

If a shared password fits the job, follow these rules:

1. Use a different password for each client or project. Do not reuse a password.
2. For sensitive content, send the password through a different channel. For example, email the link and send the password by text message or through a password manager.
3. Change the password after staff changes or accidental forwarding. Also change it when a review period ends.
4. Keep each client in a separate site or folder, so that one password cannot expose unrelated work.

How verified email access changes the evidence

Verified email access replaces a reusable group secret with proof of inbox control (access to the mailbox). It works like this:

1. The visitor opens the shared URL.
2. The visitor enters an email address.
3. The service sends a short-lived, one-time code or link to that address.
4. The visitor uses the code or link and gets access.

In most tools, you can combine this with an allowlist (a list of approved addresses) or a whole company domain. If you limit a proposal to two addresses, it stays closed to all other people, even if someone forwards the link. A company-domain rule can let in another employee. This employee then shows as a separate visitor with their own address.

Verified email proves control of an inbox at that moment. It does not prove legal identity, job title or exclusive use of a mailbox. For example, several people can read an address such as finance@example.com.

But it gives much stronger attribution than a shared password. A consultant can see that the address of the intended buyer opened a pricing proposal. The consultant does not have to guess from anonymous traffic.

Choosing secure link sharing for client documents

Use this rule: add friction only when it gives you something useful. A gate that protects nothing only causes support messages. A gate that limits forwarding or identifies a decision-maker is worth the extra step.

Use this table before you share:

Question	Low-risk answer	Higher-risk answer	Better access mode
Can the material be public?	Yes	No	Public if yes, protected if no
Will forwarding cause harm?	Little harm	Commercial, privacy or client harm	Password or verified email
Must you know who opened it?	No	Yes	Verified email
Who is the audience?	Broad or unknown	Named people or one company	Public for a broad audience, an email allowlist for named people
Does the content change often?	Rarely	Often	One stable link you update, under any suitable gate

Verizon’s 2026 Data Breach Investigations Report covers more than 31,000 incidents. More than 22,000 of them were confirmed breaches. The report found a human element in 62% of breaches and third-party involvement in 48%. These numbers do not measure leaks through document links. But they show why forwarding, wrong recipients and assumptions about identity need attention.

A simple gate can be too weak for regulated records, trade secrets, financial credentials or health information. For this material, use an approved system with the contracts, retention controls and legal review that it needs.

Which tools offer each access mode

For a website, demo or HTML report

Host	Public	Shared password	Verified email
Cloudflare Pages	Yes	No built-in password	Yes, with Cloudflare Access and the One-time PIN login
Netlify	Yes	Yes, on paid plans	No (Enterprise team login lets in only Netlify team members)
Vercel	Yes	Password Protection on Pro and Enterprise	No (Vercel Authentication asks visitors to sign in with a Vercel account)
GitHub Pages	Yes	No	Private sites only on GitHub Enterprise Cloud

For client work, Cloudflare Access is the closest match to a verified email link. In the policy of the Access application, allow specific addresses with the Emails rule. Or allow a company domain with Emails ending in. The visitor enters their address. Cloudflare emails a code only to addresses that the policy allows, and the code expires after 10 minutes.

Our Cloudflare Pages password protection guide shows the setup. It also shows the extra step that protects the production pages.dev address and each custom domain.

For a shared password on a static site, Netlify has the setting under Project configuration > General > Visitor access. For the steps, read our Netlify password guide. On Vercel, Password Protection is in the Deployment Protection settings of the project. For the steps, read the Vercel guide.

For a PDF, deck or document set

Document-sharing services give all three modes on one link. They also record the reading activity of each viewer:

• The DocSend link settings include “Require an email to view”, “Add password protection” and “Allow or block viewers by email”. “Verify email to view” needs the Advanced, Advanced Data Rooms or Enterprise plan (DocSend email verification).
• Papermark has “Require email to view” and “Require password to view” on its free plan. “Require email verification” and “Allow specified viewers” are on the Business plan (Papermark link settings).
• In Google Drive, you can keep the Restricted sharing setting and share the file with named addresses. Only the people that you add can open the file, and they must sign in. This works like an allowlist.

A practical workflow for client document sharing

This workflow needs no API and no deployment pipeline.

1. Prepare the deliverable (the work that you deliver). Remove internal comments, unused drafts, personal data and configuration files with secrets. Before you upload, open the final files one time.
2. Choose the tool by format. Put a website or an interactive demo on a static host. Put a PDF or a deck on a document-sharing service.
3. Choose the access mode. Use a public link for open distribution and a password for shared privacy. Use verified email when identity or forwarding control is important.
4. Set the audience. For verified email, allow named recipients or a company domain. If only two people need access, do not allow the full domain.
5. Test as a visitor. Open the link in a private browser window. Make sure that the gate, the navigation, the phone layout, the downloads and each form work.
6. Share one stable URL. When the work changes, publish a new version to the same site. For a document, replace the file behind the same link.

This prevents a familiar problem: proposal-final.pdf, proposal-final-2.pdf, and a third email that tells which file is current.

Using notifications and activity data without overreading them

An open notification helps with timing, but it does not prove that a decision is near. A person can open a proposal for a short time, leave it in a tab or download it for another reviewer.

The access mode controls how sure you can be about each event:

Signal	What it can mean	Sensible response
One public page view	Someone, or a link scanner, reached the URL	Wait for stronger engagement
Password open	A person with the shared secret entered	Treat identity as unknown
Verified email open	The named inbox received and used the code	Attribute access to that mailbox, with the usual limits
Long time on the pricing page	The reader looks closely at the terms	Prepare for scope or budget questions
File download	The visitor can review it offline or pass it on	Follow up with context, not pressure
Feedback submitted	The visitor made an explicit request or comment	Reply promptly to the exact point

Cloudflare’s Access authentication logs list each login with the email, the application and the time. DocSend and Papermark show the viewers and the time spent on each page. Papermark can also send you an email for each view.

For example, a founder shares an investor data room (a private set of documents) behind verified email. One investor reads the overview, comes back the next morning and downloads the financial model. This sequence is more useful than three anonymous views. The founder can send a note about the model instead of a general reminder.

Do not mention every click, and do not make the data feel like surveillance. Follow up for a legitimate business reason. If it applies to you, tell visitors about email collection and analytics. Collect only the data that you need. Delete old activity data when you no longer need it.

Secure link sharing pitfalls

Most failures occur when people think that one control is a complete solution:

Pitfall	Why it fails	Better approach
Using a public link for a private draft	Anyone with the forwarded URL can open it	Switch to a password or verified email
Calling a password visitor a named person	Other people can know the secret	Report it as an unidentified protected visit
Allowing a whole domain without need	More employees can open the link	Allow specific addresses
Sending the password with the URL	One forwarded message contains everything	Use a separate channel for sensitive work
Creating a new link for every revision	Clients open old versions, and the activity data is in many places	Update the files behind one stable URL
Collecting email with no explanation	Visitors can distrust the gate	Say why you restrict access and how you use the address
Protecting only the preview address	The production or custom domain stays open	Test every address that serves the site

Final thoughts

Choose the access mode for the job. A public link reduces friction and helps the material spread. A password keeps casual visitors out, but password access alone does not prove who visited. Verified email adds a step. But it gives better forwarding control and evidence for each visitor.

Remember these rules:

• Use public links only for material that you can treat as public.
• Use shared passwords for simple, low-risk client privacy.
• Use verified email for named audiences, sensitive proposals, data rooms and follow-up that depends on who read what.
• Keep one stable URL and update the deliverable behind it.
• Use activity data as evidence, not as proof.

Free email addresses
for your AI agents

Each agent gets an address like myagent.x7k2@revdokumail.com. It can receive emails, send replies and store files.

• 3 free mailboxes, each with its own address
• 3,000 incoming and 500 sent emails a month
• 3 GB of storage for attachments and files
• Virus, malware, spam and prompt-injection filter
• Read and reply through API, MCP or CLI

Create free mailbox

You do not need a card.