# How to share a Claude artifact with a password

> Claude can't password-protect an artifact's public link. Here's how to publish it on Outbox with a passphrase, an expiration date and the option to revoke it.

Anthropic's docs don't describe a password or an expiration for a Claude artifact's link: if it's public, anyone who has it can open it. To send a proposal or a report to a client behind a password, publish the HTML to Outbox and create a share link with a passphrase. You can also set an expiration date, name the recipient to know when they open it, and revoke it at any time.

## What Claude supports today

An artifact can be shared with your organization (Team and Enterprise) or through a link for anyone who has it. Anthropic's Help Center and the Claude Code docs describe audiences, versions and comments, but no password, expiration or record of who opened it. If the link gets forwarded, whoever receives it can see it for as long as it stays shared.

## Claude vs Outbox for a password-protected link

## 1. Publish the HTML to Outbox

Ask your agent to publish the artifact's HTML to Outbox. From Claude Code you can use the Outbox MCP server, the skill or a single API call. The page starts private: only you can see it.

```
curl -X POST https://api.out-box.dev/publish \
  -H "Authorization: Bearer $OUTBOX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"slug":"clients/acme/proposal","title":"Acme proposal","html":"<!doctype html>...","model":"claude"}'
```

## 2. Create a share link with a passphrase and an expiration

From your library (What I share), or with this API call, create a share link for that page with a passphrase and the number of days it should last. Your client opens the link, enters the passphrase and sees the page. They don't need an account.

Add a recipient and the link belongs to that person: every open is recorded under their name and you get an email when they open it. For two people, create two links.

```
curl -X POST https://api.out-box.dev/api/share \
  -H "Authorization: Bearer $OUTBOX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"resource":"clients/acme/proposal","resourceType":"post","recipient":"Laura · Acme","expiresInDays":7,"passphrase":"pick-a-long-phrase"}'
```

## 3. Send the link and the passphrase separately

The passphrase protects a forwarded link only if it doesn't travel with it. Send the link by email and the passphrase by text, or say it on the call. A phrase of several words is easier to dictate and harder to guess than a short password.

## 4. Change it, revoke it or let it expire

If the passphrase leaks, change it from What I share: the link stays the same and the old passphrase stops working. If the link leaks, revoke it and it stops working immediately. The page stays in your library, private.

If you update the page later, your client sees the new version at the same link, and you keep the version history.

## How Outbox protects the passphrase

Outbox stores only a hash of the passphrase (PBKDF2), never the text, and rate-limits repeated wrong attempts. Agent keys can't create links without an expiration: a link an agent issues always expires. For a public or unlisted page, you can also set a page-level password that every anonymous visitor has to enter.

## Comparisons

- [Outbox vs Claude Artifacts](https://out-box.dev/en/guides/vs/claude-artifacts)
- [Outbox vs Derive](https://out-box.dev/en/guides/vs/derive)

---

Updated 2026-10-11. HTML version: https://out-box.dev/en/guides/share-claude-artifact-with-password