A password-protected link encrypts a destination URL so that only someone with the correct password can reveal where it points. Instead of sending a plain link that anyone can open, the URL is encrypted client-side and embedded in the link's fragment (the part after #), which is never sent to a server. Anyone who opens the link needs the password to decrypt the fragment back into the original URL before their browser can navigate to it.

This is useful for sharing sensitive destinations — such as private documents, invite links, or internal tools — through channels that aren't fully trusted, without exposing the target address to anyone who intercepts or forwards the link.

Tool description

Link Lock Encryptor Decryptor password-protects and unlocks URLs entirely in your browser using AES-GCM encryption with a PBKDF2-derived key (100,000 iterations, SHA-256). It's compatible with the open-source Link Lock link format, so locked links created by this tool (or any other Link Lock instance) can be decrypted here, and vice versa. All encryption and decryption happens locally — the password and original URL never leave your device.

Examples

Encrypting a link

  • Input URL: https://example.com/secret-document
  • Password: my-secret-password
  • Output: A locked link like https://rapidtoolset.com/en/tool/link-lock-encryptor-decryptor#eyJ2IjoiMC4wLjEi...

Decrypting a link

  • Input: The locked link above, with the correct password
  • Output: https://example.com/secret-document

Features

  • Client-side AES-GCM encryption — the URL and password are never transmitted anywhere
  • Optional password hint — attach a hint that's stored unencrypted alongside the locked link
  • Auto-detects locked links — visiting the tool with a Link Lock fragment in the address bar automatically switches to decrypt mode

How it works

The tool derives a 256-bit AES key from your password using PBKDF2 with a random 16-byte salt and 100,000 iterations of SHA-256. It then encrypts the URL with AES-GCM using a random 12-byte initialization vector. The salt, IV, ciphertext, and optional hint are packed into a JSON object, base64-encoded, and appended after # in the link — a design that keeps the entire secret out of server logs and browser history transmitted over the network.

Limitations

  • Requires a secure browser context (HTTPS or localhost) because the Web Crypto API is unavailable otherwise.
  • Only http:, https:, and magnet: URLs can be encrypted.
  • Forgetting the password makes the locked link permanently unrecoverable — there is no password reset.