Password protect a static HTML page
A password check written in JavaScript inside the page protects nothing because anyone can read the source, so you need a host that checks the password on the server, starting with ship.page Pro at $4 a month. Or publish an unlisted link on the ship.page free plan with no signup or credit card: drop an .html file up to 10 MB, a .zip up to 25 MB (100 MB unpacked) or a folder of up to 100 files and get a live HTTPS link in seconds.
A file. A folder. A fresh start.
Your static site, one link away.
Uploading publishes your file. The link is public but unlisted, not password-protected, so leave out secrets and confidential content.
- Server-checked password protection on ship.page Pro
- $4/mo
- Max single HTML file size on every plan
- 10 MB
- Max ZIP size on Pro (400 MB unpacked, 10,000 files)
- 100 MB
- Publish free unlisted links in seconds without an account
- No signup
How to put a password on an HTML file with ship.page
Prepare your HTML file, folder or ZIP
Save a single .html file up to 10 MB, or put multi-file sites into a folder or .zip with index.html at the root. A ZIP with a single top folder is unwrapped automatically when you upload it.
Drop the file onto ship.page
Drag your .html file, .zip or folder into the browser uploader, or paste raw HTML directly. You get a live HTTPS link on its own subdomain in seconds, plus a downloadable PNG QR code.
Turn on password protection with Pro
Sign in with Google or an email link and upgrade to Pro for $4 a month (monthly billing, cancel anytime). Set a password on your page from the dashboard so the server asks visitors for it before sending your HTML.
Share the link and update it in place
Send the URL and password to your client or team. When you edit the HTML, re-upload on Pro to update the live page without changing the link, or point one of your 5 custom yourname.ship.place subdomains at it.
Ways to password protect a static HTML page
| Route | Price | Checked by the server | Setup |
|---|---|---|---|
| JavaScript prompt in the page | Free | No (password is visible in page source) | Add a script tag to your HTML file |
| ship.page Pro | $4/month | Yes | Drag and drop HTML, ZIP or folder in browser |
| Tiiny Host Solo | $18/month or $156/year | Yes | Create account, upload ZIP or HTML, enable password |
| Cloudflare Access | On your Cloudflare domain | Yes | Put Cloudflare Access in front of a site on your domain |
Why a JavaScript password prompt inside your HTML does not work
When you put a password check inside a script tag in your HTML file, the browser has to download the entire HTML file before it can run that script. Anyone who clicks View Source or opens browser developer tools can read both your password and the hidden content in plain text.
Real password protection happens on the server before the HTML file ever leaves the host. A visitor opens your link, the host serves a password screen, and your HTML, CSS, JavaScript and images are only sent after the password matches.
Tip: If you only need to keep search engines out and avoid public directories, you may not need a password at all: every ship.page upload is sent with a noindex header and is never listed anywhere public.
Which tool should you use to password protect a static site
Pick ship.page Pro when you want the fastest way to lock an HTML file, folder or ZIP behind a real password for $4 a month with monthly billing you can cancel anytime. Pro pages don't expire while you're on Pro (or you can pick any expiry from 60 seconds), show no badge, let you re-upload to the same link, and raise the limits to 100 MB ZIPs (400 MB unpacked), 10,000 files per upload and 120 deploys a minute. You also get up to 5 custom subdomains like yourname.ship.place that you can move between pages anytime.
Pick Tiiny Host Solo ($18 a month or $156 a year) if you need a custom domain alongside password protection and an API, since ship.page does not offer custom domains on any plan. Note that Tiiny Host's free plan and its $9 a month ($60 a year) Tiny plan do not include password protection, and the Tiiny Host free plan caps you at 1 active project, 3 MB per project, 3 uploads a day, and 5,000 visits and 5 GB of bandwidth a month.
Pick Cloudflare Access when your static site already runs on your own Cloudflare domain and you want to gate it with an access policy in front of that domain rather than uploading files to a separate preview host.
When an unlisted free link is enough
Many people searching for a private HTML link just want to share a website preview with a colleague without Google indexing it. On ship.page, the free plan is free forever with no signup, no credit card, no ads, unlimited uploads and no bandwidth limits.
You can publish without an account, and claim the page with a free account (sign in with Google or an email link, no card) to manage it from a dashboard. Every page gets its own random subdomain over HTTPS and a noindex header so search engines leave it out, or you can use Pro when you want custom expiry times or permanent links.
- Free limits: single HTML file up to 10 MB, ZIP up to 25 MB (100 MB unpacked), 100 files per upload, 10 deploys a minute.
- Folder uploads go up as one request of at most 10 MB (roughly 7 MB of files); zip bigger folders first.
- Static files only: HTML, CSS, JavaScript, images, fonts, audio, video, WebAssembly and JSON work; PHP, Node.js, Python, databases and WordPress do not.
- A lone PDF, image or video is not accepted by itself; put it in a folder or ZIP with an index.html file.
- Free pages cannot be updated in place (a new upload gets a new link) and show a small closable Hosted on ship.page badge.
Questions
Can I password protect an HTML file without a server?
No. A plain HTML file opened directly or hosted without server checks must send its full code to the browser first, so any visitor can view the source and read the page without typing the password. You need a host like ship.page Pro, Tiiny Host Solo or Cloudflare Access to check the password before serving the file.
How much does it cost to password protect an HTML page on ship.page?
Password protection is included in ship.page Pro for $4 a month, billed monthly so you can cancel anytime. Pro also keeps pages online while you're subscribed (or lets you set any expiry from 60 seconds), removes the badge, and lets you update a page in place while keeping the same URL.
Are free ship.page links public or searchable on Google?
Anyone who has your link can open a free page, but ship.page never lists uploads anywhere public and sends every page with a noindex header so search engines leave it out. You can publish without an account and claim the upload with a free account (no card) to manage it from a dashboard.
How does ship.page compare to Tiiny Host for password protecting HTML?
ship.page adds password protection on its $4 a month Pro plan, which allows ZIPs up to 100 MB (400 MB unpacked) and unlimited uploads with no bandwidth limits. Tiiny Host includes password protection starting on its Solo plan at $18 a month ($156 a year), which is the better pick if you also need a custom domain.
What files can I put behind a password on ship.page Pro?
You can upload a single HTML file up to 10 MB, a folder, or a ZIP up to 100 MB (400 MB unpacked) with up to 10,000 static files, including HTML, CSS, JavaScript, images, fonts, audio, video, WebAssembly and JSON. File paths are case-sensitive, and single-page apps with client-side routes should use hash routes like #/about.
Keep reading
- Password-protected website previews
- Share a website preview link
- Temporary website hosting
- ship.page Free and Pro pricing
Drop your HTML file for a private link
Publish an unlisted HTTPS link free with no signup, or lock it with a password on Pro for $4 a month.