How to password protect an HTML page without code, on your own domain

You asked ChatGPT for a report on last quarter's numbers and got an HTML page with charts and a table. It's meant for the 6 people on your board, not for everyone who ends up with the link. This guide shows why the usual JavaScript password doesn't keep anyone out, compares the 4 ways to put a page behind a password, and walks through doing it on Convika, where the password is checked on the server before the page is sent.

Why a JavaScript password doesn't protect the page

The snippet most tutorials show asks for a password and compares it inside the page's own script:

<script>
  var password = prompt("Enter the password");
  if (password !== "letmein") {
    document.body.innerHTML = "Wrong password";
  }
</script>

The browser downloads the whole file before this script runs, so the password and the text it's meant to hide both arrive with it. View Source shows them (Ctrl+U in Chrome on Windows), and a browser with JavaScript turned off never shows the prompt at all. On October 13, 2026, we published a page with this snippet and fetched it with curl, with no browser involved: the response contained the password and the sentence the script was supposed to hide.

Security references file this mistake under its own name. MITRE's CWE-602, “Client-Side Enforcement of Server-Side Security”, says: “When the server relies on protection mechanisms placed on the client side, an attacker can modify the client-side behavior to bypass the protection mechanisms” and get past the check. On Stack Overflow's question about password protecting a page with HTML, viewed 62,850 times, one answer puts it plainly: “Any password logic in css or html (or even javascript) would be useless as all of this 'code' is downloaded to the client. You need to have the password check done on the server-side.” The accepted answer sets up a password file on the server, and the highest-voted one encrypts the content so that only the password can decrypt it in the browser, which is what StatiCrypt does.

<input type="password"> is a different thing. It hides the characters someone types into a form field and protects nothing else on the page.

4 ways to password protect an HTML page

• StatiCrypt is free and open source. Its README says it “uses AES-256 and WebCrypto to encrypt your HTML file,” with the decryption happening in the browser. Because the encrypted file is public, it warns that “brute-force/dictionary attacks would be easy to do at a fast pace: use a long, unusual password.” Each time ChatGPT or Claude changes the page, you encrypt the new version and upload it again.
• Basic authentication makes the browser ask for a user name and password before the server sends anything. On Apache, you create a password file with the htpasswd tool and point an .htaccess file at it, as Apache's authentication guide shows. It works only where you control a server that reads .htaccess files.
• A host's password feature checks the password on the host's server, like Basic authentication, with nothing to install and no server files to edit.

Hosts that can put an HTML page behind a password

Checked on October 13, 2026, on each company's own pages.

• Netlify: “Basic password protection for your entire site is available on all Pro plans,” and “Password protection isn’t available on Credit-based Free and Personal plans,” say Netlify's docs. For one folder, a Basic-Auth rule in a _headers file asks for a password on that folder's pages, and “This feature is available on all Pro and Enterprise plans” (Netlify's docs). Pro is $20 a month on Netlify's pricing page.
• Vercel: Vercel's Deployment Protection docs list Password Protection as “Available on Pro for $20 per month per protected project and included on Enterprise at the team level. Not available on Hobby.” Pro itself is $20 a month (pricing).
• Cloudflare Pages: its built-in access setting “will only protect your preview deployments,” not the live site (Cloudflare's docs). For the live site, Cloudflare Access can email a one-time PIN, and “If the email is allowed by an Access policy, you will receive a PIN in your inbox” (one-time PIN). Access is free for up to 50 users.
• GitHub Pages: “GitHub Pages sites are publicly available on the internet, even if the repository for the site is private” (GitHub Docs). Publishing privately needs GitHub Enterprise Cloud, and then “A privately published site can only be accessed by people with read access to the repository” (GitHub Docs).
• Google Sites: you choose Restricted instead of Public, and then “you can share your site with specific people and add groups” (Google's help).
• Notion: “Can I password protect a page? Unfortunately, not at the moment” (Notion's help).
• ChatGPT Sites: “For limited sharing, invited visitors must sign in with the account that received access,” and Sites “is available with ChatGPT Plus, Pro, Business, Enterprise and Edu plans” (OpenAI's docs).
• Tiiny Host: the plans in its pricing page's code list “Password protection” (“Restrict who can view your content by adding a password”) from Solo, at $18 a month or $156 a year, and its feature page says: “Toggle on password protection with 1-click protection.”

Tiiny Host alternatives compared and Netlify's free plan cover what else those hosts include.

Password protect your HTML page in 5 steps

Create a free Convika account

Sign up at app.convika.com. You don't need a credit card.

Upload the HTML file

In the dashboard, click Upload an HTML file. Drop the file on the Upload a file tab, or switch to Paste code and paste what ChatGPT, Claude, Gemini, or Codex wrote. .html and .htm files up to 2 MB work. Click Create my preview. Nothing is public yet: the private preview link lasts 7 days.

Add the password in Site settings

On the page's dashboard screen, scroll to Site settings and find Page password. Type a password of 8 to 128 characters (letters A–Z, numbers, symbols, and spaces), and click Add password. On Pro you can do this before or after you publish. If you haven't published a page yet, you can add it on Free too: the section says that publishing starts Pro free for 14 days, and that visitors see the password screen from the first visit.

Publish

Click Publish, then Publish again in the dialog. The page goes live at an address like yourpage.convika.com, behind the password. To use your own subdomain, such as docs.yourbrand.com, connect it from Manage domains on the page's dashboard screen: Free includes 1, and Pro has no limit.

Send the link and the password separately

Send the link in one message and the password in another, for example the link by email and the password by text. Someone who has only the link sees the password screen.

What your visitors see

On October 13, 2026, we put 5 test pages behind a password this way and opened them in a browser that had never signed in, and with curl.

• A password screen at your address. It says “This page is password protected,” with one field and a View page button. When the page's language is Japanese, the screen is in Japanese.
• None of the page until the password is right. The screen comes back with status 401, and in our test its response held neither the page's title nor any of its text: Convika checks the password on its server before it sends the page. The same happened on the first visit to a page whose password was added before its first publish.
• A wrong password shows “That password doesn't match. Check it and try again.” After 10 wrong passwords from the same IP address in a 15-minute window, the screen asks the visitor to wait before trying again.
• The right password opens the page, and the browser remembers it for 7 days. In our test, reloading the page opened it without asking again.
• A new password locks everyone out again. After you click Change password, everyone who entered the old one sees the password screen on their next visit. Remove password opens the page to anyone with the link.
• Search engines see only the screen. It's marked noindex, the page is left out of your address's sitemap, and browsers and caches are told not to keep a copy.
• Your preview link skips the password. The dashboard's preview link opens the page without it, for your own review, so send the published address.
• Publishing again keeps the password. In our test, a new version published after the password was added still showed the password screen.

If you don't keep Pro. When the 14 free days end and the workspace stays on Free, the page keeps its password, so it never goes public by itself. On Free you can remove the password, and changing it needs Pro.

Keep the form and the visit count behind the password

• The form works only for people who entered the password. Click Add a form to my page on the page's dashboard screen, and entries land in your dashboard; Pro has no monthly cap on them. In our test, an entry sent from a browser without the password got a 401 and wasn't saved, and the entry from the visitor who entered the password showed up in the dashboard. How to make the form on your AI-made page work explains the form.
• Visits count once the password is right. The screen itself isn't counted: in our test, a browser that stopped at the screen and a visitor who got through made 1 pageview and 1 visitor in the dashboard. How to see who visits your page explains each number.

Which to pick

• You run an Apache server: Basic authentication. It costs nothing extra, and your server checks the password.
• One file for a few people, on any host: StatiCrypt, free. Use a long, unusual password, since the encrypted file can be downloaded and tried offline.
• The site is already on Netlify Pro or Vercel Pro: turn on their password feature, at the prices above.
• Each viewer must sign in as themselves, or you need to know who opened it: an identity-based gate, such as Cloudflare Access's emailed codes. Convika gives each page one shared password and counts visits, not names.
• A page ChatGPT or Claude made, on your own domain, behind one password, with a form and visit counts: Convika, on Pro at $12 a month after the 14 free days.

Frequently asked questions

Can you password protect an HTML file?

Yes, in 2 ways that hold up: encrypt the file, or host it where a server checks the password. StatiCrypt encrypts the whole file, and the browser decrypts it after the right password. A host with a password feature, such as Convika on Pro, sends the page at its published address only after the right password. A password written into the file's own HTML or JavaScript doesn't count, because anyone who has the file can read it.

Is a JavaScript password on an HTML page secure?

No. The password and the content are both in the file the browser downloads, so View Source or curl shows them, and turning JavaScript off skips the prompt. MITRE lists this as CWE-602, client-side enforcement of server-side security. Have a server check the password instead: Basic authentication, a host's password feature, or Convika's Page password.

How do I put a password in HTML?

For a password field in a form, use <input type="password">: it hides the characters as people type them. For a whole page that asks for a password, HTML alone can't do it. A server has to check the password before it sends the page, or the file has to be encrypted, as the 4 ways above describe.

How do I make a password protected HTML page without coding?

Upload the HTML file to a host that has a password setting, and turn it on. On Convika, click Upload an HTML file, drop the file or paste the code, click Create my preview, add a password under Page password in Site settings, and publish. You install nothing and edit no server files.

Can you password protect GitHub Pages?

Not with a password. GitHub's docs say Pages sites are public on the internet even when the repository is private. Private publishing needs GitHub Enterprise Cloud, and then only people with read access to the repository can open the site. For a password, encrypt the file with StatiCrypt before you push it, or put the page on a host with a password feature. Can you use GitHub Pages for a business site? covers GitHub's other rules.

Can you password protect a Google Sites page?

No. Google Sites has no password setting. You can set the published site to Restricted and share it with specific people by name or email address, according to Google's help. To share with people you can't add by email, use a host with a password.

Can you password protect a Notion page?

No. Notion's help says: “Can I password protect a page? Unfortunately, not at the moment.” You can invite people who have a Notion account instead. For a password, publish the content as an HTML page on a host that has one.

How do I password protect a Netlify or Vercel site?

Both need a paid plan. Netlify's password protection is on Pro, at $20 a month, and covers the entire site; for a single page, put it in a folder and add a Basic-Auth rule for that folder to a _headers file, also on Pro. On Vercel, Password Protection costs $20 a month per protected project on top of Pro, at $20 a month, and isn't available on Hobby. Tiiny Host includes a password on Solo, at $18 a month, and Convika on Pro, at $12 a month.

How do I share a password-protected link?

Send the link and the password in separate messages. On Convika, the link is the page's own address: anyone who opens it sees the password screen first, and after the right password, their browser opens the page for 7 days. Tools that only lock a link, such as Link Lock, are different: its README says that “If the password is correct, Link Lock retrieves the original URL and then redirects there,” so anyone who learns the real address skips the password.

Can each page have its own password?

On Convika, yes. Each page has its own password under Page password in its Site settings, and pages without one stay public. On Netlify, the site-wide password covers every page, and a Basic-Auth rule covers one folder; Vercel charges for each protected project. A Convika password is shared by everyone you give it to; there are no separate passwords for each viewer.