How to Create Private Access Links for Content (2026 Guide)
TL;DR
A private access link is a URL that restricts who can view your content without making it fully public. There are four main methods: unlisted links, password-protected links, token-based secure links, and invite-only access. Each balances recipient friction against security differently. This guide explains every method, shows how to create private access links for content on popular platforms, and helps you pick the right approach for your situation.
You spent weeks building a portfolio. The work is strong, some of it covered by NDA, and you need to share it with a recruiter by tomorrow morning. Making it public is off the table. Sending a password feels clunky. What you need is a private access link, a URL that lets the right people in and keeps everyone else out.
The concept is simple. The execution, surprisingly, is where most people get tripped up. No single resource on the internet covers the full picture: what private access links actually are, how the different types compare, and how to create them across platforms. This guide fills that gap.
If you’re building a recruiter-ready portfolio, KnolMe offers built-in private access control on its Pro plan, so you can skip the workarounds entirely.
What Is a Private Access Link?
A private access link is an unguessable URL that grants access to a specific resource (a portfolio, document, video, or profile) without requiring the recipient to have an account or public access. Unlike a regular public URL, it is not indexed by search engines, not linked from any public page, and not discoverable through browsing.
The concept relies on the URL itself being hard to guess. As security researchers have documented, these links work by generating a URL that “isn’t hyperlinked, isn’t crawlable by search engines, and isn’t guessable by humans or computers.” The underlying mechanism often uses a GUID (globally unique identifier), a random 128-bit hexadecimal string so enormous that the odds of someone stumbling onto it are essentially zero.
This matters because it gives you a middle ground between “fully public” and “fully locked down.” You can share your work with specific people without forcing them through login screens or account creation.
The Four Types of Private Access
Not all private access links work the same way. They fall on a spectrum from low-friction/low-security to high-friction/high-security. Understanding this spectrum is essential before you decide how to create private access links for content in your specific situation.
Unlisted Links (Hidden, Not Protected)
An unlisted link is hidden from public navigation, search results, and recommendations. But anyone who has the URL can view, share, and even embed the content. YouTube’s unlisted video setting is the most familiar example: the video won’t appear in search or on your channel page, but the link works for anyone who clicks it.
Photography platform SmugMug makes the distinction explicit in their documentation: “Unlisted is a navigation setting, not a security setting. It does not restrict who can view your content if they have the link.”
Best for: Internal drafts, non-sensitive previews, content you want accessible but not discoverable.
Password-Protected Links
A password-protected link adds one layer of authentication. The recipient clicks the URL and enters a password before the content loads. No account creation needed, no login wall, just a shared secret.
This is the most common approach for client deliverables and NDA-covered portfolio work. Many platforms, from Vimeo to Webflow to Squarespace, support it natively.
Best for: Client deliverables, NDA portfolios, content where you need basic access control without friction.
Token-Based Secure Links
Token-based links embed a unique, cryptographic identifier directly in the URL. Each recipient can get their own link, and you can revoke access for one person without affecting anyone else. GitBook, for example, generates a private token within the URL that gives non-members read-only access.
From the recipient’s perspective, these links feel just like a normal URL. No password, no login. They click and they’re in. But behind the scenes, you have granular control over who has access and can cut it off at any time.
Best for: Recruiter sharing, per-person access tracking, situations where you need zero friction for the viewer but full control on your end.
Invite-Only (Account-Based) Access
The most secure option ties access to specific identities. Recipients must have an account and receive an explicit invitation. Some platforms use unique redemption tokens so that even a forwarded invitation email can’t be reused by someone else.
The trade-off is friction. Your recipient needs to create an account, verify their email, and log in. That’s acceptable for sensitive intellectual property or regulated content. It’s a dealbreaker for cold recruiter outreach.
Best for: Sensitive IP, legal documents, regulated industries, long-term collaborations.
Side-by-Side Comparison
| Method | Recipient Friction | Security Level | Can You Revoke Access? | Best Use Case |
|---|---|---|---|---|
| Unlisted URL | None (just click) | Low | Must change entire URL | Non-sensitive drafts |
| Password-protected | Low (enter password) | Medium | Change the password | NDA portfolios, client work |
| Token-based link | None (just click) | Medium-High | Revoke individual tokens | Recruiter sharing |
| Invite-only | High (needs account) | High | Remove from access list | Regulated/sensitive content |
The Biggest Mistake: Treating “Unlisted” as “Private”
This confusion is everywhere. Practitioners on Reddit, Webflow forums, and Adobe Portfolio communities make the same error: they assume that hiding a page from navigation makes it private.
It doesn’t.
Unlisted means hidden from search. Private means protected from access. These are fundamentally different things. An unlisted YouTube video, for instance, can be watched, shared, and screen-recorded by anyone who gets the link. As one video security analysis puts it, “That isn’t private sharing. It’s security through obscurity, a model that fails the moment someone forwards a link to the wrong inbox.”
Adobe Portfolio users on community forums have shared a common workaround: duplicating a portfolio page, hiding the copy from navigation, and sharing its URL directly. But as other users quickly pointed out, omitting a URL from navigation doesn’t stop search engines from finding it. The only reliable protection is actual access control.
This distinction matters enormously for anyone sharing portfolios with recruiters. If your NDA-covered case study is “unlisted” rather than truly private, you’re one forwarded email away from a contract violation.
How to Create Private Access Links for Content by Platform
The steps differ depending on what you’re sharing and where it lives. Here’s how to set up private access across the most common platforms and use cases.
For Portfolios and Personal Profiles
Webflow: You can password-protect individual pages through the page settings panel. But there’s a critical gotcha that most users miss. Practitioners on Webflow’s forums report that if you add password protection after the page has already been live, search engines may have already crawled and indexed the content. Even worse, uploaded files (PDFs, images) linked from a password-protected page are not themselves password-protected. Only the page wrapper is. Someone with the direct file URL bypasses protection entirely.
Adobe Portfolio: Adobe doesn’t offer token-based or per-link access controls. The community workaround of hiding pages from navigation provides zero actual security. For true privacy, you’re limited to password protection at the site level.
Journo Portfolio: Offers a “secure link” option that functions like a token-based approach. Only someone with the specific secure link can access the portfolio. Everyone else sees a page asking them to contact the owner. This is closer to what most people actually want when they think about private access.
KnolMe: For personal profiles specifically, KnolMe’s Pro plan includes private access control as a built-in feature. Because profiles are auto-generated from URLs, files, or even ChatGPT memory in about 30 seconds, the workflow is significantly faster than building and then locking down a Webflow or WordPress site. If you want to understand how that import process works, there’s a walkthrough on generating a profile from existing documents.
For Documents
Google Drive/Docs: Google offers two main modes. “Anyone with the link” is essentially an unlisted approach. “Restricted” limits access to specific Google accounts you invite. For something in between, you can share a link but require viewers to request access, which you approve manually.
Notion: Shared pages can be set to “Anyone with the link” (unlisted) or restricted to specific workspace members. Notion doesn’t currently support password protection or token-based links for external sharing.
GitBook: Their share link feature generates a private token embedded in the URL. You create it through the docs site’s settings under “Audience,” then name and distribute individual links. Non-members get read-only access through a clean interface that looks like any other published page.
For Videos
Vimeo: The gold standard for private video sharing. Vimeo lets you create multiple unique share links for the same video, each with its own password protection, expiration date, and engagement metrics. This means you can send different links to different clients and track exactly who watched what, for how long.
YouTube: Limited to unlisted and private modes. Unlisted is not truly private (as discussed above). Private restricts viewing to specific Google accounts, which requires your recipient to be signed in. There’s no password or token-based middle ground. For anything beyond casual sharing, YouTube’s privacy controls fall short. If you’re embedding video content in a portfolio, consider reading about embedding YouTube and Spotify on portfolio pages to understand the display options.
For Code Repositories
GitHub: Repository visibility can be set to private, with collaborator invitations sent to specific GitHub accounts. For sharing code samples without granting repo access, you can create private Gists (which are unlisted, not truly private) or use tools like GitShare that generate recruiter-friendly preview links.
GitBook (for documentation): As mentioned above, token-based share links work well for API docs or technical documentation you want to share selectively.
For Personal Profiles Shared with AI Agents
This is a newer consideration. As AI agents like ChatGPT and Claude increasingly access web content, “private access” now has a second dimension: do you want AI agents to read your profile even if humans can’t browse to it freely?
Some platforms are starting to address this. KnolMe, for example, positions itself as “built for AI agents,” meaning your profile can be agent-readable for automations and referrals while still controlling human access. If you’re interested in making your profile work for both humans and AI, the guide on building an agent-friendly profile covers the technical details.
The Recruiter Friction Problem
The top Google result for this topic is a Reddit thread from r/UXDesign. That alone tells you something: this is a pain point that existing platforms haven’t solved well.
The core dilemma is real. Designers and developers with NDA-covered work need to show it to recruiters, but recruiters are notoriously impatient. Adding a password to your portfolio creates friction. Including the password in your resume (a common suggestion) defeats the purpose. And sending the password in a separate message means the recruiter needs to check two communications just to see your work.
Practitioners on Reddit and Webflow forums consistently report the same frustration: they want a private link that “just works” for the recipient while still keeping the content hidden from the public.
Token-based links solve this problem cleanly. The recruiter gets a URL that opens directly, no password needed. You can track whether they accessed it. And if you need to revoke access later (say, after accepting a different offer), you disable that specific token without affecting links you’ve shared with other people.
For a deeper look at building portfolios specifically for the hiring process, the guide on creating scannable portfolios covers layout and content decisions alongside access control.
Best Practices for Private Access Links
Knowing how to create private access links for content is only half the equation. Managing them well is what prevents security failures down the road.
Send Links and Passwords Through Separate Channels
If you use password protection, never send the password in the same email as the link. If that email gets forwarded (intentionally or not), both credentials travel together. Send the link via email and the password via text message, or vice versa.
Set Expiration Dates by Default
Most people create private links and forget about them. Old links accumulate. Six months later, a former client still has access to your latest case studies. Platforms like Vimeo let you set expiration dates per link. Use this feature. If your platform doesn’t support it, put a recurring reminder on your calendar to review active links quarterly.
Prefer Token-Based Links When Friction Matters
If your recipient is a recruiter, potential client, or anyone who didn’t specifically ask to jump through hoops, token-based links are the right call. They combine zero friction for the viewer with granular control for you. Password-protected links are fine for ongoing client relationships where both parties expect the extra step.
Review and Revoke Stale Links Quarterly
Treat shared links like keys to your house. When a project ends, revoke access. When you change jobs, regenerate links. A simple quarterly audit prevents the slow accumulation of access that nobody remembers granting.
Think About AI Agent Access
A growing number of AI tools crawl and index web content. If your private access link is purely obscurity-based (unlisted), AI crawlers may still find and process it. Consider whether your content should be readable by AI agents, and choose platforms that give you explicit control over this. The guide on publishing profiles in machine-readable formats explains how this works in practice.
When to Use Which Method: A Quick Decision Framework
Choosing how to create private access links for content comes down to two questions: how sensitive is the material, and how much friction can you impose on the recipient?
Low sensitivity, unknown audience (blog draft, event page, internal memo):
Use an unlisted link. It’s fast and frictionless. Just don’t pretend it’s secure.
Medium sensitivity, known audience (client deliverable, NDA portfolio, course material):
Use a password-protected link if the recipient expects it, or a token-based link if you want zero friction. Either way, send credentials through a separate channel.
High sensitivity, specific recipients (legal documents, trade secrets, regulated data):
Use invite-only access tied to verified accounts. The friction is justified.
Recruiter/hiring context (portfolio with NDA work, selective case studies):
Token-based links are the clear winner. No password for the recruiter to fumble with, and you can revoke access after the hiring process ends.
For anyone building a recruiter-ready profile with private access baked in, KnolMe’s Pro plan at $2.99/month handles this without requiring you to wire together multiple tools.
Frequently Asked Questions
What’s the difference between an unlisted link and a private access link?
An unlisted link is hidden from search engines and public navigation, but anyone who gets the URL can access and share the content freely. A private access link adds actual access control through passwords, tokens, or account verification. Unlisted is a navigation setting. Private is a security setting.
Can someone forward my private access link to others?
It depends on the method. Password-protected links can be shared along with the password. Token-based links can be forwarded too, but you can revoke individual tokens without affecting other recipients. Invite-only links with unique redemption tokens are the hardest to share because each invitation can only be redeemed once.
How do I share NDA-covered portfolio work with recruiters?
The lowest-friction approach is a token-based secure link. The recruiter clicks the URL and sees your work immediately, no password or account needed. You maintain control and can revoke access later. Avoid putting passwords directly in your resume, as this defeats the purpose of protection.
Do search engines index private access links?
Properly implemented private access links (password-protected, token-based, or invite-only) should not be indexed. However, if content was publicly accessible before you added protection, search engines may have already cached it. Always add access controls before publishing, not after.
What happens if I forget to revoke old private links?
The links remain active indefinitely unless your platform supports automatic expiration. This means former clients, ex-colleagues, or past recruiters retain access to your content. Set expiration dates where possible, and review active links at least once per quarter.
Should I worry about AI agents accessing my private content?
Yes. AI crawlers from companies like OpenAI and Google actively index web content. An unlisted link offers no protection against these crawlers. If you want your content to be private from both humans and AI, use password or token-based protection. Some platforms, like KnolMe, give you separate controls for human visitors and AI agents.
Is a GUID-based URL truly secure?
A GUID (globally unique identifier) provides 128 bits of randomness, making it computationally infeasible to guess. For most use cases, this level of obscurity is sufficient. However, GUIDs protect against guessing only. They don’t prevent someone from sharing the link with unauthorized people. For true security, pair a GUID-based URL with password protection or token revocation.
Can I create private access links for free?
Many platforms offer basic private link features on free tiers. Google Drive, YouTube (unlisted), and Notion all provide some form of link-based sharing at no cost. More advanced features like per-recipient tokens, expiration dates, and analytics typically require paid plans. For personal profiles, KnolMe offers a free tier with core features and private access control on the Pro plan.
For more guides on building and sharing professional profiles, browse the KnolMe blog.