How to password protect an HTML page without code, on your own domain

You ask ChatGPT for a report on last quarter's numbers, and it gives you an HTML page complete with charts and a table. That page is meant for the 6 people on your board, not for everyone who stumbles across the link. This guide explains why the usual JavaScript password keeps no one out, compares the 4 ways to put a page behind a password, and shows you how to do it on Convika, where the server checks the password before it sends the file.

Why a JavaScript password does not protect your page

Most tutorials show the same basic snippet. It asks your visitor for a password, then compares what they typed directly inside the page's own script.

<script>
  var password = prompt("Enter the password");
  if (password !== "letmein") {
    document.body.innerHTML = "Wrong password";
  }
</script>

Your visitor's browser downloads the entire file before any script runs. The password and the hidden text arrive on their computer right away. Anyone can press Ctrl+U in Chrome on Windows to open View Source, where both sit in plain text. If someone turns JavaScript off, the prompt never appears at all. In our test on October 13, 2026, we published a page with this snippet and fetched it using curl without a browser. The raw response contained the password and the exact sentence the script was supposed to hide.

Security references call this mistake CWE-602, “Client-Side Enforcement of Server-Side Security” from MITRE: “When the server relies on protection mechanisms placed on the client side, an attacker can modify the client-side behavior to bypass the protection mechanisms”. On Stack Overflow's question about password protecting a page with HTML, viewed 62,850 times, one answer puts it plainly: “Any password logic in css or html (or even javascript) would be useless as all of this 'code' is downloaded to the client. You need to have the password check done on the server-side.”. The accepted answer recommends a password file on the server. The highest-voted answer suggests encrypting the content so only the correct password can decrypt it inside the browser, which is how StatiCrypt works.

Do not confuse this script with <input type="password">. That tag only masks characters as you type them into a form field. It protects nothing else on the page.

4 ways to password protect an HTML page

• StatiCrypt is free and open source. As its README explains, it “uses AES-256 and WebCrypto to encrypt your HTML file,” and your browser decrypts the page. Anyone can download the encrypted file. The README warns that “brute-force/dictionary attacks would be easy to do at a fast pace: use a long, unusual password.” When ChatGPT or Claude changes your page, you encrypt the new file and upload it again.
• Basic authentication stops visitors at the server door. Your browser prompts you for a user name and password before the server sends any page data. On Apache, you create a password file with the htpasswd tool and link an .htaccess file to it, following Apache's authentication guide. This setup works only when you control a server that runs .htaccess files.
• A host's password feature checks passwords on the host's server, just like Basic authentication. You do not edit server files or install extra tools.

Hosts that can put an HTML page behind a password

Here is how different hosts put an HTML page behind a password. Each detail comes directly from each company's own pages, checked October 13, 2026.

• Netlify: According to Netlify's docs, “Basic password protection for your entire site is available on all Pro plans,” and “Password protection isn’t available on Credit-based Free and Personal plans,”. For one folder, a Basic-Auth rule in a _headers file asks for a password on that folder's pages. Netlify's docs state: “This feature is available on all Pro and Enterprise plans”. Pro costs $20 a month on Netlify's pricing page.
• Vercel: Vercel's Deployment Protection docs list Password Protection as “Available on Pro for $20 per month per protected project and included on Enterprise at the team level. Not available on Hobby.” Pro itself costs $20 a month (pricing).
• Cloudflare Pages: The built-in access setting “will only protect your preview deployments,” not the live site (Cloudflare's docs). For the live site, Cloudflare Access can email a one-time PIN: “If the email is allowed by an Access policy, you will receive a PIN in your inbox” (one-time PIN). Access is free up to 50 users.
• GitHub Pages: According to GitHub Docs, “GitHub Pages sites are publicly available on the internet, even if the repository for the site is private”. Private publishing needs GitHub Enterprise Cloud. Then, “A privately published site can only be accessed by people with read access to the repository” (GitHub Docs).
• Google Sites: Choose Restricted instead of Public. Then, “you can share your site with specific people and add groups” (Google's help).
• Notion: Notion's help states: “Can I password protect a page? Unfortunately, not at the moment”.
• ChatGPT Sites: OpenAI's docs note that “For limited sharing, invited visitors must sign in with the account that received access,”. Sites “is available with ChatGPT Plus, Pro, Business, Enterprise and Edu plans”.
• Tiiny Host: Plans in the code of its pricing page list “Password protection” (“Restrict who can view your content by adding a password”) from Solo, at $18 a month or $156 a year. Its feature page notes: “Toggle on password protection with 1-click protection.”

To see what else these hosts include, read Tiiny Host alternatives compared and Netlify's free plan.

Password protecting your HTML page in 5 steps

Create a free Convika account

Sign up at app.convika.com. You do not need a credit card.

Upload the HTML file

On your dashboard, click Upload an HTML file. Drop your file onto the Upload a file tab, or open Paste code and paste what ChatGPT, Claude, Gemini, or Codex wrote. Convika accepts .html and .htm files up to 2 MB. Click Create my preview. Nothing is public yet. Your private preview link works for 3 minutes, and Open preview gives you a fresh one whenever you click it.

Choose the password when you publish

Click Publish page. Under Who can open this page?, choose Only people with the password. Type a password of 8 to 128 characters using letters A–Z, numbers, symbols, or spaces, and click Next. Passwords come with Pro, so the first time you publish, Convika shows an order for Pro monthly (1 day free with a card, then $12 a month). Click Subscribe, free for 1 day and add your card on the next screen. For the 1-year pass ($29, paid once, no renewal), click Get the 1-year pass instead ($29, paid once) under the button first, then pay on the next screen. Already on Pro? The button reads Publish with password instead of Next, and you can add or change a password any time under Page password in Page settings with Add password.

Publish

Your page goes live behind the password once the trial starts or the pass is paid, at an address like yourpage.convika.page. If you want to use your own subdomain, such as docs.yourbrand.com, click Manage domains on the page's dashboard screen. Free accounts include 1 custom subdomain, and Pro accounts have no limit.

Send the link and the password separately

Send the link in one message and the password in another. For example, email the link and text the password. Anyone who opens only the link sees the password screen.

What your visitors see

Here is what happens when someone visits your protected link. On October 13, 2026, we tested 5 test pages behind a password this way, opening them in a browser that had never signed in, and with curl.

• A password screen at your address. It says “This page is password protected,” with one field and a View page button. The screen follows your visitor's browser language: a browser set to Japanese shows it in Japanese. A language Convika doesn't have gets English.
• None of the page until the password is right. The screen returns a 401 status. In our test, the response held neither the page's title nor any of its text. Convika checks the password on its server before sending the page. You get the same result on the first visit to a page whose password was added before its first publish.
• A wrong password shows “That password doesn't match. Check it and try again.” If an IP address enters 10 wrong passwords within 15 minutes, the screen asks the visitor to wait before trying again.
• The right password opens the page, and the browser remembers it for 7 days. In our test, reloading opened the page without asking again.
• A new password locks everyone out again. After you click Change password, everyone who entered the old one sees the password screen on their next visit. Selecting Remove password leaves the page open to anyone with the link.
• Search engines see only the screen. The screen is marked noindex, and Convika leaves the page out of your address's sitemap. Browsers, and caches, are told not to keep a copy.
• Your preview link skips the password. The dashboard's preview link opens the page without it so you can review your work. Send the published address when you share it with others.
• Publishing again keeps the password. In our test, a new version published after the password was added still showed the password screen.

If you don't keep Pro. Your page never goes public by itself. If your Pro, or your 1-year pass, started at or after midnight (00:00) Japan time on October 24, 2026 and ends without payment, the page goes offline; choose Pro again, or publish it as Public on Free, to bring it back. If your Pro started before then, the page keeps its password: on Free, you can remove the password, but changing it needs Pro.

The form and the visit count behind the password

• The form works only for people who entered the password. Turn on Add a form to my page on the page's dashboard screen. Entries land in your dashboard. Pro has no monthly cap. In our test, an entry sent from a browser without the password returned a 401 and was not saved. An entry from the visitor who entered the password appeared in the dashboard. Read How to make the form on your AI-made page work.
• Visits count once the password is right. The screen itself is not counted. In our test, one browser stopped at the screen and one visitor got through. That resulted in 1 pageview and 1 visitor in the dashboard. Read How to see who visits your page.

Which method to pick

• You only want to keep the page out of Google, and anyone with the link can open it: You don't need a password for that. On Convika, choose Private link (Pro or pass) when you publish—anyone with the link can open the page without a password or account, while Convika tells search engines to keep it out of their results and leaves it out of the sitemap (step up to Only people with the password if the link might get forwarded). The free Public choice may show up in search results and in Convika's gallery. On any host, adding <meta name="robots" content="noindex"> in the page's <head> also asks search engines to keep it out of results.
• You run an Apache server: Use basic authentication. You pay nothing extra. Your own server checks the password before it serves the page.
• One file for a few people, on any host: Pick StatiCrypt. It is free. Choose a long, unusual password, because anyone can download the encrypted file and guess passwords offline.
• The site is already on Netlify Pro or Vercel Pro: Turn on their built-in password feature. Use the prices listed above.
• Each viewer must sign in as themselves, or you need to know who opened it: Set up an identity-based gate, such as Cloudflare Access with emailed codes. Convika uses one shared password for the entire page, and it tracks total visits rather than visitor names.
• A page ChatGPT or Claude made, on your own domain, behind one password, with a form and visit counts: Choose Convika. It is $12 a month on the Pro plan, or $29 once for the 1-year Pro pass, which you can pick when you publish your first page.

Frequently asked questions

Can you password protect an HTML file?

Yes, two ways hold up: encrypt the file, or host it where a server checks the password. StatiCrypt encrypts the whole file, and the browser decrypts it after you enter the right password. A host with a password feature, such as Convika on Pro, sends the page at its published address only after the visitor enters the right password. A password written directly into the file's HTML or JavaScript does not count. Anyone with the file reads it.

Is a JavaScript password on an HTML page secure?

No. The password and the content both sit inside the downloaded file. Using View Source or curl shows them right away. If a visitor turns JavaScript off, their browser skips the prompt completely. MITRE tracks this flaw as CWE-602, client-side enforcement of server-side security. Have a server check the password with Basic authentication, a host's password feature, or Convika's Page password.

How do I put a password in HTML?

HTML alone cannot protect a whole page with a password. To hide characters on the screen as someone types in a form, you use an <input type="password"> field. For a full page that asks for a password, HTML cannot do the job on its own. A server must check the password before sending the page, or you must encrypt the file using one of the 4 ways above.

How do I make a password protected HTML page without coding?

Upload the file to a host that includes a password setting, then turn that setting on. On Convika, select Upload an HTML file, drop your file in or paste your code, and click Create my preview. Click Publish page, choose Only people with the password, type a password, and click Next. Then order Pro monthly, or the 1-year pass from the link under the order's button, and the page goes live behind the password once the trial starts or the pass is paid. You have nothing to install, and you never edit server files.

Can you password protect GitHub Pages?

No, you cannot protect GitHub Pages with a password. GitHub's docs state that Pages sites stay public even when your repository is private. Private publishing requires GitHub Enterprise Cloud, which lets only people with read access to the repository open the site. To use a password, encrypt the file with StatiCrypt before pushing, or pick a host with a password feature. Read more on Can you use GitHub Pages for a business site?.

Can you password protect a Google Sites page?

No, Google Sites has no password setting. Google's help explains that you set the published site to Restricted and share it with specific people by name or email. If you need to share your page with people you cannot add by email, move the page to a host with a password.

Can you password protect a Notion page?

No. Notion's help states: “Can I password protect a page? Unfortunately, not at the moment.” You must invite people with a Notion account instead. If you want a password, publish your content as an HTML page on a host that has one.

How do I password protect a Netlify or Vercel site?

Both Netlify and Vercel require a paid plan for passwords. Netlify offers password protection on Pro for $20 a month, which covers the entire site. To lock a single page on Netlify, you place it in a folder and write a Basic-Auth rule for that folder in a _headers file, which also requires Pro. Vercel charges $20 a month per protected project on top of its $20 a month Pro plan, and leaves the feature off Hobby. Tiiny Host charges $18 a month on Solo. Convika includes it on Pro for $12 a month.

How do I share a password-protected link?

Send the link and the password in separate messages. On Convika, the link is the page's own address. The opener sees the password screen first, and typing the right password lets their browser open the page for 7 days. Tools that only lock a link, like Link Lock, work differently. As its README explains: “If the password is correct, Link Lock retrieves the original URL and then redirects there,” which means anyone who learns the real address skips the password.

Can each page have its own password?

Yes, on Convika each page can have its own password. You choose it when you publish the page, or on Pro under Page password in Page settings on that page, while pages without one stay public. Netlify sets a site-wide password that covers every page, or uses a Basic-Auth rule for one folder. Vercel charges you per protected project. A Convika password is shared by everyone you give it to, without separate passwords for individual viewers.