You sent a video to a client via a private link. The client forwarded the link to their team. Someone on the team shared it in a shared Slack channel. A day later, your "private" video has been viewed by 200 people unrelated to the project. For a pre-release advertising campaign, this is a disaster. For a wedding film, it's a privacy breach. For a corporate video, it's a potential leak.

A password breaks this chain. Without the password, the link is useless, and forwarding it is pointless. It's not absolute protection—and it shouldn't be. It's a practical barrier that ensures that only people with the password can view the video. Yet the tools most people send video with don't offer one: an unlisted YouTube video opens for anyone who has the link, and Google Drive controls access through Google accounts, not passwords. Private hosts like VodSpot work differently: every delivery page can carry its own password on every plan, along with an expiration date and instant revocation. For the vast majority of professional tasks—client deliveries, pre-release materials, internal communications, private events—this barrier is sufficient.

This article discusses when a password is truly necessary, how to manage it without creating unnecessary friction, and how to combine passwords with other access control tools.

When a password is really needed

Not every video requires a password. An unnecessary barrier creates friction for the client and unnecessary work for you. The decision should be based on one question: what happens if the wrong person sees the link?

Password required:

  • Pre-release materials. The brand has a launch date, and any leak ruins the strategy. A password ensures that even a forwarded link won't open the video without authorization.
  • Weddings and private events. A couple or organizer may not want private footage to be accessible to anyone with the URL. Guests not invited to the event shouldn't watch the video.
  • Corporate internal communications. Management communications, HR materials, and training sessions often contain employee-only information. A password prevents an accidental forwarding from becoming an information leak.
  • Working under an NDA. Some clients include confidentiality clauses in their contracts. A password provides demonstrable access control for compliance purposes.
  • Preview before approval. When sharing work that has not yet been approved for public distribution, a password prevents premature distribution.

A password is most likely unnecessary:

  • A portfolio you're showing to a potential client—friction works against you here.
  • A behind-the-scenes video for a brand's social media that will be published anyway.
  • Content already approved for public release.
  • Internal test links within your own team.

The rule is simple: if the consequences of unauthorized viewing are significant, use a password. If the worst-case scenario is a minor inconvenience, a private link is sufficient.

Problem Scope: Why Links Travel

The clearest lesson in what happens to a link without a password came in the spring of 2020. Schools, support groups and companies moved to Zoom almost overnight, and meeting links started circulating in group chats and on social media. Strangers began joining calls and flooding them with offensive images—"Zoombombing," as TechCrunch's Josh Constine named it. The FBI issued a warning after children's online classes and Alcoholics Anonymous meetings were hit. Zoom's fix was blunt: from April 5, 2020, joining a call by Meeting ID required a password, because the IDs could be guessed or reused (TechCrunch).

Forwarding isn't only a stranger's game. In a Ponemon Institute survey of 1,100 IT professionals in three countries, commissioned by Intralinks, 61% admitted they "often or frequently" handled files in risky ways—sharing them through unencrypted email, accidentally forwarding documents to unauthorized people, or using personal file-sharing apps at work (CSO Online). If the people responsible for security do this, your client's marketing team certainly does—and cloud storage links leak the same way.

A password breaks this chain at the very first step. A forwarded link without the password is just a login screen, and the number of people who can actually watch stays close to the number you intended. In VodSpot, that screen gives nothing away—no video, no project title, no cover—until the right password goes in.

How to choose the right password

The delivery password should be simple enough for the recipient to enter and unpredictable enough that a random person can't guess it. Neither extreme works: "password123" is useless, while a 32-character random string guarantees support tickets.

Principles:

  • Unique password for each delivery. Reusing the same password for all projects means that any client who received a previous delivery can access the new one. This is especially risky if you work with competitors in the same industry.
  • No personal information. Don't use the client's name, company name, project name, or any information displayed on the delivery page. Someone who sees the title "Harper Campaign" and tries "harper" as a password shouldn't be able to access it.
  • Reasonable length and memorable. A two-word combination or short phrase is memorable and unpredictable enough. "BlueSparrow" or "Maple42Road" are easy to communicate over the phone and difficult to guess.
  • Never reuse your account passwords. Delivery passwords are, by definition, shared with other people. They should not be linked to your personal accounts or banking information.

The U.S. National Institute of Standards and Technology came to a similar conclusion in its current digital identity guidelines, SP 800-63B: length and unpredictability matter more than tricks. NIST tells services to stop forcing mixtures of letters, digits and symbols, and to reject commonly used or compromised passwords instead (NIST). For a delivery password, that becomes a simple rule: two or three unrelated words beat "Pr0ject!" every time.

At VodSpot, each delivery has its own password field, independent of your account and other deliveries. You set it once, share it with the client, and can change or remove it at any time without affecting other projects.

How to Send a Password Correctly

The method of sending a password is almost as important as the password itself. The most common mistake is including the link and password in the same message. This means anyone who sees the message will have full access.

For sensitive content, separate the channels:

  • Send the link via email, the password via SMS or messenger
  • Send the link in the project management system, the password in a private message
  • Send the link in an official letter, the password by phone

Separating the channels means that a compromise of one channel does not grant access. Anyone who intercepts the email does not have the password. Anyone who sees the SMS does not have the link.

For everyday deliveries with moderate sensitivity, it's acceptable to include both in a single message. Use clear formatting:

Your videos are ready: [delivery link]

Password: BlueSparrow

Don't hide the password in the middle of a long paragraph. It should be immediately visible, preferably on a separate line, and clearly labeled.

Be sure to warn the customer. Tell them that they will be prompted for a password when they open the link, and tell them who to contact in case of problems. A customer who doesn't expect a password prompt may assume the link is broken and leave.

Combine passwords with lifecycle controls

The password determines who can enter. Lifecycle controls determine how long the door remains open and what visitors can take with them. Together, they form a practical security policy covering the entire delivery cycle.

An expiration date limits how long a delivery remains available:

  • A campaign preview may expire on the launch day
  • A rough delivery may expire after the review period ends
  • A wedding film may remain open for a year so the couple can return to it

On VodSpot, you set an expiration date on any delivery. After this date, the link stops working—the client sees a "delivery not available" message instead of the content. If they need access again, you extend or remove the limitation without creating a new link.

Instant revocation is a kill switch. Unlike an expiration date, which waits for a scheduled date, a revocation takes effect immediately:

  • The working relationship with the client has ended unexpectedly
  • You discover that the incorrect version was delivered
  • The content has become sensitive due to external circumstances
  • A client employee who had access has left

Download control determines whether the recipient can save a copy of the video. Password-protected delivery with downloads enabled means the client can keep the video forever. If the goal is viewing only, disable downloads to ensure the content exists only on your platform.

VodSpot provides separate controls for streaming and downloading originals. You can allow the client to watch the video in the browser but keep the master file locked until final payment or approval. This gives you control over the final product without blocking viewing.

Focus on customer experience

Security measures that confuse customers are self-defeating. If the password prompt is unclear, the customer will take the path of least resistance and ask you to simply upload the video to Google Drive without any protection.

Access page design principles:

  • Clear password prompt. The customer should see a clean page with a clear input field, not a technical error that could mean anything. On VodSpot, secure deliveries display a branded access page with your logo and a clear input field.
  • Sender identification. The customer should immediately know who the delivery is from. If the access page displays the name of an unknown platform instead of your brand, the customer may not trust the link.
  • Clear error messages. An incorrect password should say "Incorrect password," not "Access denied" or a technical error code.
  • Don't show project details before authentication. The access page shouldn't display the project name, video preview, or other details before entering the password. This prevents a situation where someone who finds the link knows the content of the delivery without even being able to view it. Names alone can give a lot away: in 2019, the security firm Adversis found that dozens of companies had exposed hundreds of thousands of documents—passport photos, bank account numbers, product prototypes—through Box links, and the researchers located them simply by brute-forcing file and folder addresses (CyberScoop).

How fast does a client decide whether to trust your access page? Gitte Lindgaard and her colleagues at Carleton University in Ottawa showed people web pages for just 50 milliseconds—a twentieth of a second—and asked them to rate them. Those snap judgments closely matched the ratings people gave after studying the same pages at leisure (Nature). The client decides whether the page looks legitimate before reading a word on it. A branded access page with your logo and name passes that test; an anonymous gray form makes them wonder whether to type anything at all.

Test the password experience yourself before sending. Open the link in a private window, enter the password, verify that playback starts, and check the access page is correct. Two minutes of testing prevents support requests.

What a password doesn't solve

A password prevents unauthorized viewing, but it doesn't prevent content capture by an authorized viewer. Someone who watches a video can record their screen, take photos, or share the content with others. No access control can completely prevent this.

This is important to understand when setting customer expectations. Don't promise "complete security" or "guaranteed protection" based on a password. Be clear:

  • A password ensures that only authorized people can access your delivery link.
  • It prevents cascading—a forwarded link is useless without the password.
  • It creates a record of intentional access—someone actively entered the password.
  • It does not prevent copying of what an authorized viewer can see.

For situations requiring more stringent protection—legal processes, highly sensitive corporate content, materials with significant financial value—additional measures may be required: watermarks, named access, contractual NDAs. VodSpot covers the first two: email access shows exactly who opened a delivery (Pro plan and up), and a moving watermark with the viewer's email discourages recording (Studio and Production). But for the vast majority of professional video delivery, a password, combined with an expiration date and the ability to revoke, provides a practical, proportionate level of security.

Build the password into the process

The most effective approach is to make the password decision part of the standard delivery process, not an afterthought. When setting up a new delivery, determine the access level based on the project type:

  • Standard Delivery — private link, no password, reasonable expiration date
  • Sensitive or Pre-Release Content — private link plus password, password through a separate channel, shorter expiration date
  • High Security Delivery — password, short expiration date, downloads disabled, revocation as soon as the project closes

Document these levels in your process so you don't have to make decisions from scratch every time. Over time, clients will get used to what to expect from your deliveries, and password requests will be seen as a normal part of receiving professional work—not an obstacle.

Determine the security level you use most often—for example, a password plus a 60-day expiration date—and apply it to every new delivery by default. At VodSpot, setting a password and expiration date takes a few seconds for each delivery. Adjust for a specific project as needed, but let habit guide the routine.

The goal is not to build a fortress around every video. The goal is to match security to content and communicate this security clearly. A client who understands the purpose of a password and how to use it will appreciate professionalism. A client who struggles with an incomprehensible login page will remember the frustration, not the security.

Frequently Asked Questions

How do I password protect a video link?

Upload the video to a host that supports passwords per link or per delivery, set the password and send it to the viewer. In VodSpot you choose Password as the access mode of a delivery page, enter 8 to 128 characters and publish. Anyone who opens the link sees your branded password screen first, without the video, the project title or the cover.

Is a password-protected video link secure?

It is a strong practical barrier, not absolute protection. A forwarded link without the password is useless, wrong guesses are rate-limited, and the page reveals nothing about the project before the password is entered. It cannot stop an authorized viewer from recording the screen, so for high-stakes content add an expiration date, email access or a watermark.

What happens when I change the password?

Everyone who already opened the delivery is signed out and needs the new password, so a password change works as a quick reset after a leak. In VodSpot the new password takes effect as soon as you save the page, and the link itself stays the same, so there is nothing to resend except the password.

Can I password protect a video on Google Drive or YouTube?

Not really. YouTube has no password option—an unlisted video opens for anyone who has the link—and Google Drive controls access through Google accounts, not passwords. Vimeo supports password-protected videos, and private hosts like VodSpot include passwords on every plan, together with expiration dates and one-click revocation.

Is a password or email access better for client videos?

A password is quick: one secret for everyone who should watch. Email access is more precise: each viewer confirms their address with a one-time code, you can limit the page to named addresses, and analytics show exactly who opened and downloaded. In VodSpot email access is available during the trial and on the Pro, Studio and Production plans.

How do I send a video password to a client safely?

Use two channels for sensitive work: the link by email, the password by text message, messenger or phone. For routine deliveries one message is fine—put the password on its own clearly labeled line and warn the client that the page will ask for it. Never reuse a password across clients or deliveries.