Password-protected links
Lock any Zippy link behind a password — visitors enter it before the redirect, and Zippy only ever stores a scrambled hash of it, never the real password.
Password-protected links
A password-protected link asks every visitor for a password before Zippy sends them on. Nobody sees the destination — not even a link preview — until they type the right password.
Great for a private drop, a paid resource, a client hand-off, or a link you only want your close friends to open.
Password protection is available on Hero and up.
How it works
- You set a password on the link (in the dashboard or the mobile app).
- A visitor opens the short link and sees a small "This link is locked" page.
- They type the password. If it's right, Zippy remembers it on their device for a while and sends them on to the destination — springing the native app just like any Zippy link.
- If it's wrong, they stay on the lock screen and can try again.
The destination is never revealed until the password is correct. Social platforms that fetch a link to build a preview card see the lock screen, not your destination — so a protected link doesn't leak its target in an unfurl either.
We never store your real password
Zippy only ever stores a slow, salted one-way hash (PBKDF2) of your password — never the plaintext. The password you type lives only in the request that sets it; after that, even we can't read it back, and the slow, salted hash means it can't be reversed even if the stored value ever leaked. When someone enters a password to unlock the link, Zippy hashes what they typed the same way and compares the two — the real password is never transmitted or stored anywhere.
Because of that, there's no "show my password" — if you forget it, just set a new one.
Set it up
Dashboard (web): in the ZIP form or a link's editor, open Password protection, tick Require a password, and type one. To change it later, type a new one; to remove the lock, untick the box and save.
Mobile app: open a link's detail screen, use the Password section — flip the switch, type a password, and save. To remove it, switch it off and save.
Changes take effect immediately; the short link itself never changes, so anything you've already shared keeps working — it just starts (or stops) asking for the password.
It still opens the native app
Once a visitor unlocks the link, the destination is treated like any Zippy destination: it springs the right native app where one exists — including out of the Instagram / TikTok in-app browser — not just a web redirect.
Notes
- The unlock is remembered per device via a short-lived cookie, so a visitor isn't asked again on every tap. The cookie carries a derived token, never your password or its hash.
- Password protection composes with UTM tracking and audience routing — the gate comes first, then Zippy resolves the right destination and tags it.
- A password can be up to 200 characters. Pick something you can share with the people who should get in.