How do you password-protect an online photography gallery?

Controls vary by service, but the reliable workflow is the same: set the gate, verify it as a signed-out visitor, publish the change, and test the live link before sharing access.

Public, unlisted, password-protected, and unpublished are not interchangeable. Match the setting to the consequence if a link travels beyond the intended group.

A gallery password is strongest as a practical social and access boundary for a known audience.

A wedding or event preview shared with a family before public selection.

A portrait sitting awaiting subject approval.

An unpublished editorial story under embargo.

A classroom or workshop critique.

A private family archive or community history selection.

A work-in-progress sequence shared with an editor, curator, mentor, or collaborator.

A portfolio gallery is designed for viewing a selected body of work. A client-delivery suite may add favorites, proofing, per-person accounts, downloads, contracts, invoices, expiration policies, print sales, or detailed activity records.

Use a protected portfolio gallery when the main task remains viewing a selected sequence.

Use specialist proofing when viewers must approve, reject, or annotate individual photographs.

Use specialist delivery when original or high-resolution file transfer is the primary task.

Use an access-managed repository when each viewer needs a separate identity and revocation.

Do not promise that a browser gallery prevents saving, screenshots, or password forwarding.

Use a unique password that is easy for the intended viewers to enter but difficult to guess. A short sequence of unrelated words is usually more usable than a name, event date, or reused account password.

For routine low-risk sharing, a direct message containing both may be enough. When the work is more sensitive, send the link and password through separate channels. You might send the link by email and the password by text or voice.

Tell viewers what the gallery contains and whether they may share access.

State the expected review period.

Do not place the password in the URL, gallery title, or public social post.

Test the gate in a private browser window before sending it.

Use the protected gallery’s direct URL rather than asking viewers to search the portfolio.

Password protection does not remove the need for consent and restraint. Check whether every photograph belongs, whether metadata reveals a sensitive location, and whether names or captions expose information the audience does not need.

Remove GPS details for homes, sensitive habitats, vulnerable people, or private locations.

Confirm permissions and expectations with recognizable subjects.

Avoid uploading files that should not be viewed in a browser at all.

Keep local masters and delivery records outside the portfolio.

Change the password, unpublish, or remove the gallery when its purpose ends.

A password prompt may be only one part of the service’s behavior. Check whether protected galleries disappear from normal portfolio navigation, carry a noindex instruction for search engines, expose titles or cover images before unlock, and remain accessible at the same URL after a password change. These measures can reduce casual discovery; they cannot guarantee that a recipient will keep the link, password, or viewed images private.