> ## Documentation Index
> Fetch the complete documentation index at: https://learn.biq.li/llms.txt
> Use this file to discover all available pages before exploring further.

# Password-protect a link

> Require visitors to enter a password before opening a destination.

Password protection places an access screen in front of a link destination.

1. Create or edit the link.
2. Open **Restrictions**.
3. Enter a password.
4. Save the link.

Visitors must enter the correct password before Biqli redirects them. The
dashboard and API report only whether a password exists. They do not return the
saved password.

To change the password, enter a new one and save. To remove protection, clear
the password field and save the link.

<Warning>
  A password-protected short link is an access control, not encrypted file
  storage. The destination itself should still enforce any security required for
  sensitive information.
</Warning>

## Choose and store the password

Use a unique password that is practical for the intended audience. Share it
through a separate channel from the short URL when access matters. Biqli stores
the protected value and returns only `has_password` in resource views and API
responses.

Anyone who knows the password can pass the link gate. There are no individual
viewer accounts at this layer, so change the password when a recipient should
no longer have access.

## Test protected access

Open the short URL in a private browser window. Confirm that Biqli asks for the
password before redirecting, rejects an incorrect value, and accepts the saved
value. Repeat the test after changing or clearing the password.

## Common problems

* If no prompt appears, confirm the link still reports that it has a password.
* If a saved password fails, make sure you tested the current link and did not
  copy whitespace with the value.
* If the editor does not offer password protection, review the workspace plan
  and your link write permission.

Password protection works together with active, schedule, expiration, safety,
and targeting rules. Passing the password does not override another rule that
makes the link unavailable.