How to share a Claude artifact with a password
Anthropic's docs don't describe a password or an expiration for a Claude artifact's link: if it's public, anyone who has it can open it. To send a proposal or a report to a client behind a password, publish the HTML to Outbox and create a share link with a passphrase. You can also set an expiration date, name the recipient to know when they open it, and revoke it at any time.
What Claude supports today
An artifact can be shared with your organization (Team and Enterprise) or through a link for anyone who has it. Anthropic's Help Center and the Claude Code docs describe audiences, versions and comments, but no password, expiration or record of who opened it. If the link gets forwarded, whoever receives it can see it for as long as it stays shared.
Claude vs Outbox for a password-protected link
| Claude artifact | Outbox | |
|---|---|---|
| Password on the link | Not described in the docs | Optional passphrase on every link |
| Expiration | Not described in the docs | 7, 30, 90 or 365 days, or no expiry |
| A different link per person | No | Yes, named after the recipient |
| Alert when it's opened | No | Email to whoever created the link |
| Revoke | Unshare or unpublish | Revoke the link; the page stays in your library |
| Your brand on the access screen | No | Your name and logo on the passphrase screen |
1. Publish the HTML to Outbox
Ask your agent to publish the artifact's HTML to Outbox. From Claude Code you can use the Outbox MCP server, the skill or a single API call. The page starts private: only you can see it.
curl -X POST https://api.out-box.dev/publish \
-H "Authorization: Bearer $OUTBOX_API_KEY" \
-H "Content-Type: application/json" \
-d '{"slug":"clients/acme/proposal","title":"Acme proposal","html":"<!doctype html>...","model":"claude"}'2. Create a share link with a passphrase and an expiration
From your library (What I share), or with this API call, create a share link for that page with a passphrase and the number of days it should last. Your client opens the link, enters the passphrase and sees the page. They don't need an account.
Add a recipient and the link belongs to that person: every open is recorded under their name and you get an email when they open it. For two people, create two links.
curl -X POST https://api.out-box.dev/api/share \
-H "Authorization: Bearer $OUTBOX_API_KEY" \
-H "Content-Type: application/json" \
-d '{"resource":"clients/acme/proposal","resourceType":"post","recipient":"Laura · Acme","expiresInDays":7,"passphrase":"pick-a-long-phrase"}'3. Send the link and the passphrase separately
The passphrase protects a forwarded link only if it doesn't travel with it. Send the link by email and the passphrase by text, or say it on the call. A phrase of several words is easier to dictate and harder to guess than a short password.
4. Change it, revoke it or let it expire
If the passphrase leaks, change it from What I share: the link stays the same and the old passphrase stops working. If the link leaks, revoke it and it stops working immediately. The page stays in your library, private.
If you update the page later, your client sees the new version at the same link, and you keep the version history.
How Outbox protects the passphrase
Outbox stores only a hash of the passphrase (PBKDF2), never the text, and rate-limits repeated wrong attempts. Agent keys can't create links without an expiration: a link an agent issues always expires. For a public or unlisted page, you can also set a page-level password that every anonymous visitor has to enter.
Comparisons
Frequently asked questions
Does my client need an account to open the link?
No. They open the link in any browser and type the passphrase.
Is the password included in the free plan?
Yes. Links with a passphrase, expiration and open alerts come with every Outbox plan, Free included.
What happens when the link expires?
It stops opening the page. The page stays in your library and you can create a new link whenever you want.
Related guides
Sources
Updated 2026-10-11.