Password Protect An HTML Page, With Real Encryption

Search for a way to password protect an HTML page and most of what you find does the same thing: it drops a line of JavaScript into your page that compares what someone types against a password written a few lines below, then reveals content that was sitting in the file all along. Anyone can press Ctrl+U and read both. It is theatre. This tool does the real thing instead - it encrypts the page - and the difference is visible in the output: open the file it makes and there is nothing to read but base64.

How It Works

Your password is stretched into a 256-bit key with PBKDF2-HMAC-SHA256 over 600,000 rounds and a fresh random 16-byte salt, and that key encrypts your page with AES-256-GCM under a fresh random 12-byte initialisation vector. The file that comes out carries the salt, the initialisation vector and the ciphertext, and a small unlock form. When a visitor types the password, their browser repeats the derivation and asks AES-GCM to decrypt. A wrong password fails GCM's authentication tag, which cannot be faked or worked around, so the page simply does not open. All of that happens on the device: the password never leaves your browser, and nothing is uploaded until you press publish.

Who It Is For

Anyone who has a page that should be on a link but not in public: a designer sending a client proposal, an agency sharing a draft, someone putting up event details for invited guests, a teacher handing out course notes, or a developer who wants to lock an HTML page for a staging preview without standing up a server. If you are holding a finished HTML file from a chatbot, an export or a template and you just need it behind a password, this is the whole job in a minute.

Its Real Limits

Be clear about what encrypting a page in the browser can do. The ciphertext is in the file, which means anyone who saves the file can try passwords offline, on their own machine, for as long as they like. The 600,000 rounds make each attempt expensive - it is the same order of work factor password managers use - but a short or guessable password will still fall. That is why the tool refuses to build a file for a password under eight characters and shows you an estimated offline guessing time for the one you typed. Treat this as protection against casual access: stopping a link being forwarded round an office, keeping a draft out of search results, keeping a proposal from a curious colleague. It is not a replacement for a login, it cannot be revoked once you have sent the password, and it does not stop someone who is genuinely determined and knows what they are doing.

A few practical notes as well. The page needs JavaScript and the Web Crypto API, which means HTTPS or the file opened directly from your own machine - a plain http:// address will not decrypt. Search engines can only ever see the lock screen, so a protected page cannot be indexed for its content. And because encryption turns the page into base64, the file grows by about a third, which matters if you were already near the 5 MB instant-publish limit. If you only want to look at a page rather than lock it, the HTML viewer renders it safely, and the coming soon page generator is the better answer when you want a holding page everyone can see.

Then Put It On A Link

Publish below and the protected page is on a free OxyPages address with HTTPS in seconds, no account needed, so you can send the link and the password separately and watch it work. That link lasts 30 minutes; claiming it is free, keeps it, and lets you pick your own address. When the content matters enough that the file itself should never reach the wrong browser, OxyPages has password protection as a hosting feature on paid plans, handled by the server rather than by the file. Compare plans or read how it works.