Password-protect an HTML page, with a passcode on a private link.

Why a password, when the URL is already unguessable

A Stacktree link is private by default: it lives at a token URL with roughly 128 bits of entropy, is never listed or indexed, and is served with crawler-blocking headers. If you never share the link, nobody finds the page. So why add a password at all?

Because links travel. A URL that is private the moment you create it can still be forwarded, pasted into a shared channel, or left in a browser history on a borrowed machine. A passcode is the second factor for exactly those cases: it means holding the link is not enough, the viewer also has to know a secret you set. For a client deliverable, a quote, an internal report, or anything you would not want opened by whoever the link reaches next, that second layer is the difference between "hard to find" and "needs permission."

How to set it

• In the dashboard. Open the site, set a password, done. The page now prompts for it before rendering.
• At publish time. Include a password when you upload the file, so the page is protected from its first second.
• From an agent, over MCP. Call set_password with the password (or null to clear it). The same agent that published the page can lock it, so the whole flow stays in one place.

However you set it, the password is hashed before storage, so Stacktree never holds the plaintext. Removing or rotating it is a one-line change and never moves the URL.

Password-protecting a Claude or Codex artifact

This is the most common reason people reach for it, and the tools themselves do not cover it. A Claude.ai artifact can be made public, but there is no passcode option, so "shared" means "anyone with the link." Claude Code artifacts and Codex Sites are the opposite, locked to your organization with no password and no external viewer at all.

Hosting closes the gap. Export the artifact to a self-contained HTML file, or have your agent publish it directly, put it on Stacktree, and set a password. Now you can hand a client or a contractor a link plus a passcode, with no Claude or OpenAI seat required to open it, and on your own domain if you want. The page is the same self-contained HTML the artifact already was; you have just added the lock the source tool left out.

Layer it: password, email gate, expiry, burn

A password is one option in a small set you can combine to match the sensitivity of what you are sharing:

• Password for a shared secret with a person or small group.
• Email-domain gate for a company audience, where viewers verify a work address by magic link. Mutually exclusive with a password on a single page.
• Expiry from minutes to never, so a link does not outlive its purpose.
• Burn after read for a one-time view that deletes itself once opened.
• End-to-end encryption for the most sensitive pages, where the key lives only in the URL fragment and Stacktree stores ciphertext it cannot read.

A passcode plus a short expiry covers most "share this carefully" situations without any of it being complicated.