# How to password protect and privately share a video

Use an unlisted link for a client review, a password for anything you would mind a stranger watching, and a domain lock so a copied embed code cannot play anywhere but your own site. All three are settings on the video, not separate uploads. None of them is DRM: a viewer who can watch can record.

- Section: Guides (https://videokr.com/guides)
- Page: https://videokr.com/guides/password-protect-video
- Last updated: 2026-08-18

## Pick the level that matches the risk

| Situation | Use |
| --- | --- |
| Draft for a client to approve | Unlisted link |
| Paid course lesson | Password, plus a domain-locked embed on the members' area |
| Internal all-hands recording | Password plus domain lock |
| Marketing video on your own site | Public, domain-locked to your hostnames |

## Unlisted

The page exists, carries `noindex`, and appears in no sitemap or public listing. Anyone with the link can watch. Right for reviews and one-off shares; wrong for anything that would be embarrassing if forwarded.

## Password

The page asks for a password before it plays, and a correct entry issues a short-lived token for that viewer. Practical notes: one password per audience rather than per person, rotate it when a cohort ends, and never put the password in the same email as the link if the email might be forwarded.

## Domain-locked embeds

List the hostnames allowed to embed the video, wildcards included (`*.example.com`), and the player refuses everywhere else. This is the setting that makes stealing your embed code pointless, and the one most people forget. In Videokr it lives beside visibility — see [private video](/docs/privacy).

## What none of this does

It is not DRM. Screen recording exists. Access control raises the effort from "copy the URL" to "deliberately re-record", which is the right target for course content and client work. If your business genuinely requires hard protection, you need an encrypted-media pipeline and a vendor who sells exactly that.

## The self-hosting version

Doing this yourself means signed URLs with short expiries, a referrer or Origin check at the CDN, and a token issuer of your own — plus the discipline to keep them working. Fine if you already run that infrastructure; see [self-hosted vs hosted video](/guides/self-hosted-vs-hosted-video) for the honest trade.

## FAQ

### Can a password-protected video still be embedded?

Yes — the embed accepts an access token issued after the password is entered, so a members’ area can play it without asking twice.

### Is unlisted the same as private?

No. Unlisted means unindexed and unlisted, but anyone holding the link can watch. Use a password when the link itself is not enough.

## Related

- [Private video: passwords, domain locking and unlisted](https://videokr.com/docs/privacy)
- [Videokr as a Vimeo alternative](https://videokr.com/compare/vimeo-alternative)
- [Hosting course video without a course platform](https://videokr.com/blog/course-video-hosting)
- [Self-hosted video vs a hosted platform](https://videokr.com/guides/self-hosted-vs-hosted-video)

---
Videokr — Videokr is hosted video for marketing sites: upload or link a video, brand the player, capture emails inside it, embed it anywhere and read second-by-second retention. Free tier forever, $69 lifetime, or metered plans.
Plans: https://videokr.com/#pricing · Full reference: https://videokr.com/llms-full.txt