Password Protected Photo Sharing — How It Works

Why password protect your shared photos?

A share link without a password is only as private as the people you send it to. One accidental forward, one group chat screenshot, one "hey check this out" message — and suddenly your private photos are accessible to people you never intended.

Password protection adds a real barrier. Even if the link gets forwarded or posted somewhere it shouldn't be, nobody can view the content without the password. It's not theoretical — it's practical access control.

Here are the situations where it matters most:

• Wedding galleries for the couple only. You want guests to see the photos, but not the entire internet. A password-protected album link shared in your wedding group chat keeps it contained.
• Family albums that should stay in the family. Baby photos, holiday gatherings, personal moments — things you want grandparents to see but not random strangers if the link leaks.
• Client deliverables for photographers. When you're sending a gallery to a client, password protection ensures only the paying client accesses the final photos, not anyone they happen to share the URL with.
• Sensitive personal photos. Vacation photos that reveal your location, photos of your home, photos of your children — anything where unauthorized access has real consequences.

How password protected sharing works

The concept is straightforward, regardless of which platform you use. Here's the typical flow:

• Step 1: Create an album and upload your photos.
• Step 2: Generate a share link for the album.
• Step 3: Set a password on the link. Choose something simple enough for your family to type but not easily guessable — a short phrase works well.
• Step 4: Send the link to your recipients via WhatsApp, email, SMS, or any messaging app. Send the password separately (or in the same message if you trust the channel).
• Step 5: The recipient opens the link, enters the password, and sees the full gallery. No account needed, no app to download.

The key difference between platforms is how they handle the password technically. Some store it in plaintext (bad). Some hash it with a proper algorithm (good). And some simply don't offer the feature at all. For a deeper look at photo sharing privacy practices, see our photo sharing privacy guide.

Password protected sharing — app comparison

Not every photo platform supports password protection. Here's an honest comparison of what the major players offer.

The gap is clear: Google Photos and iCloud — the two most popular photo platforms — have no password protection at all. If you share an album link, anyone with that link can view it. WeTransfer and Dropbox offer password protection on paid plans, but they show files as downloads, not as a photo gallery. For a broader comparison of private sharing apps, see our guide to the best private photo sharing apps.

How Viallo's password protection works

When you set a password on a Viallo share link, here's what happens behind the scenes:

• Bcrypt hashing (12 rounds): Your password is hashed using bcrypt with 12 salt rounds before it's stored. The plaintext password is never saved anywhere. Even if someone gained access to the database, they'd only find the hash — not the actual password.
• Independent passwords per link: Each share link has its own password. If you share the same album with two different links (say, one for family and one for a friend), each can have a different password. Changing one doesn't affect the other.
• Revocable access: You can revoke any share link instantly. The link stops working immediately — no grace period, no cached access. If you suspect the password has been shared too broadly, kill the link and create a new one with a new password.
• HTTPS transport encryption: All connections between the viewer's browser and Viallo's servers are encrypted with TLS. The password is never sent in plaintext over the network.
• Server-side storage encryption: Photos stored on Cloudflare R2 in Europe are encrypted at rest using AES-256 server-side encryption.

A note on what this is and isn't

Viallo's security model is HTTPS (transport encryption) + Cloudflare R2 server-side encryption (AES-256) + bcrypt password hashing. This is solid, industry-standard security that protects your photos in transit and at rest.

However, Viallo does not offer end-to-end encryption. Your photos are encrypted on the server, but Viallo has server-side access to process and serve them. If you need zero-knowledge encryption where even the service provider cannot access your files, consider Ente or Proton Drive. The trade-off is that those services cannot offer the same sharing experience — gallery views, location maps, and no-account viewing require server-side processing.

Beyond passwords — additional privacy controls

Password protection is one layer. For people who take photo privacy seriously, there are several more controls worth knowing about.

• Hidden photos per link: You can selectively hide specific photos from a shared link without deleting them from your album. Share your vacation album with colleagues but hide the beach photos. Share with extended family but hide the unflattering candids.
• Revoke access instantly: One tap and the link goes dead. No waiting period, no cached versions. If you suspect the link has spread beyond your intended audience, kill it in seconds.
• View analytics: See exactly who viewed your album, when they viewed it, and from what device. If you shared the link with 5 people but see 50 views, you know the link was forwarded. This is a privacy tool, not just a vanity metric.
• No account required for viewers: Viewers tap the link, enter the password, and see the gallery immediately. No sign-up form, no app download. If they later create a Viallo account, all previously viewed albums are automatically assigned to their profile. For more on account-free sharing, see our guide to sharing photos without an account.
• EXIF metadata stripping: When viewers access your shared photos, EXIF metadata (GPS coordinates, device info, timestamps) is stripped from the delivered files. Your location data stays private even when photos are shared.

Getting started with password protected sharing

Setting up password protected sharing on Viallo takes about one minute:

• Create an album and upload your photos (drag and drop, or select from camera roll).
• Tap "Share" on the album to generate a unique link.
• Toggle on password protection and set your password. Use something your recipients can easily type — a short phrase like "familyphotos2026" works well.
• Copy the link and send it however you normally reach your people — WhatsApp, email, SMS. Include the password in the message or send it separately for extra security.

Password protection is available on Plus and Pro plans. The free plan includes link sharing without passwords — still private (random 16-byte hex link IDs that are impossible to guess), but without the password barrier.

Frequently Asked Questions