How to password protect and privately share a video
Use an unlisted link for a client review, a password for anything you would mind a stranger watching, and a domain lock so a copied embed code cannot play anywhere but your own site. All three are settings on the video, not separate uploads. None of them is DRM: a viewer who can watch can record.
Pick the level that matches the risk
| Situation | Use |
|---|---|
| Draft for a client to approve | Unlisted link |
| Paid course lesson | Password, plus a domain-locked embed on the members' area |
| Internal all-hands recording | Password plus domain lock |
| Marketing video on your own site | Public, domain-locked to your hostnames |
Unlisted
The page exists, carries noindex, and appears in no sitemap or public listing. Anyone with the link can watch. Right for reviews and one-off shares; wrong for anything that would be embarrassing if forwarded.
Password
The page asks for a password before it plays, and a correct entry issues a short-lived token for that viewer. Practical notes: one password per audience rather than per person, rotate it when a cohort ends, and never put the password in the same email as the link if the email might be forwarded.
Domain-locked embeds
List the hostnames allowed to embed the video, wildcards included (*.example.com), and the player refuses everywhere else. This is the setting that makes stealing your embed code pointless, and the one most people forget. In Videokr it lives beside visibility — see private video.
What none of this does
It is not DRM. Screen recording exists. Access control raises the effort from "copy the URL" to "deliberately re-record", which is the right target for course content and client work. If your business genuinely requires hard protection, you need an encrypted-media pipeline and a vendor who sells exactly that.
The self-hosting version
Doing this yourself means signed URLs with short expiries, a referrer or Origin check at the CDN, and a token issuer of your own — plus the discipline to keep them working. Fine if you already run that infrastructure; see self-hosted vs hosted video for the honest trade.
Frequently asked questions
Can a password-protected video still be embedded?
Yes — the embed accepts an access token issued after the password is entered, so a members’ area can play it without asking twice.
Is unlisted the same as private?
No. Unlisted means unindexed and unlisted, but anyone holding the link can watch. Use a password when the link itself is not enough.