The wedding gallery you delivered in June is open on a stranger's phone in a group chat, because a share link travels the way all links travel: forwarded, pasted, screenshotted. A password is the obvious fix, and whether you can add one depends entirely on which tool made the link.
What a password on a client gallery actually protects
A client gallery password makes the link useless to anyone not also given the password, and that is most of what it does. It is not encryption, and it stops nobody who gets the link and password in one message.
Sharing tools mix three access levels:
- Anyone with the link. The common default: whoever holds the URL is in, forwards included.
- Link plus password. The link alone is not enough.
- Named viewers or an email gate. The viewer signs in or types an email address first. Most accountable, most friction.
Hiding a gallery is not locking it. As SmugMug's help center puts it, "Unlisted is a navigation setting, not a security setting."
ShootProof's gallery security guide has password rules worth borrowing:
- Long. At least 12 characters, mixing cases, numbers and symbols.
- Unguessable. No client names, dates or session type, and no keyboard paths like 1234.
- Unique. A different password for each gallery.
- Watched. "If you see suspicious activity in your Gallery Visitor Report, change passwords immediately."
Tip. Ask any gallery vendor two questions: does the password gate the photo files or only the page, and what happens to people already inside when you change it or switch the link off?
Which cloud share links can take a password
Of the links most client photos already travel on, only Dropbox offers a link password, and only on paid plans.
| Option | Link password | Other gates | Expiry | Cost |
|---|---|---|---|---|
| Google Drive link | No | Named Google accounts | Work and school accounts only | Free |
| Google Photos album | No | None | None | Free |
| iCloud Shared Album | No | Approve participants | 30 days if temporary | Free |
| Dropbox shared link | Paid plans | Downloads off, paid plans | Paid plans | Paid plans, Professional and up |
| Proofing gallery (ShootProof, SmugMug) | Yes | Visitor email, invited people | Varies | Plans vary, see vendor |
| Tagrly catalog link | Pro and Business | Email gate, Pro and Business | Every plan | Password on Pro and Business; first 500 photos free |
Google Drive, Google Photos and iCloud
Google Drive's general access is Restricted or Anyone with the link, per Google's Drive sharing help, and neither takes a password. Add expiration works only per named person on work and school accounts, so a personal account gets no expiry either. Google Photos links have no password at all.
For one client with a Google account, Restricted sharing is still sound; sharing photos with clients from Google Drive covers it. iCloud Shared Albums let you approve participants instead, and Apple shows no password option.
Dropbox
Dropbox has real link passwords and expiry on Professional, Essentials, Standard, Advanced, Business, Business Plus and Enterprise, per its link settings page, but not on Basic, Plus or Family.
The password binds only people who arrive through the link: "Anyone added directly, or who already has access, keeps their existing permissions." And the client still lands in a file browser, not a gallery.
Proofing galleries: a client gallery password plus accounts
For shoot-by-shoot delivery, proofing galleries stack a gallery password with visitor emails and client accounts, and that bundle is the right buy when the gallery is the product.
- ShootProof. Private galleries reachable only by direct link, a gallery password, a required visitor email with a Gallery Visitor Report, and download rights for linked contacts.
- SmugMug. Each gallery is open to Anyone, or limited to People with Password or to People I Choose, who are invited by email.
- Pic-Time. Its help center describes per-person accounts: main clients always sign in, while a guest link, by default, can view and download without one.
Some now search inside one delivered gallery: Pic-Time's AI photo search on its Advanced plan, and Zenfolio's Face Finder selfie search. A catalog link searches a slice of a whole library across shoots instead; what clients can search in each gallery type compares them.
A password plus a search box: the catalog gallery route
For an archive a client queries month after month, the gallery behind the password needs a search box, and that takes a tagged catalog underneath.
A catalog such as Tagrly reads every photo in your Drive or Dropbox and records a focal subject, context tags and alt text, the method called focal-subject tagging. The pass runs unattended in the background.
Tagrly offers two kinds of share link:
- A collection link. A curated set, no search box.
- A library link. A client search box over the AI-written tags; narrow it to chosen collections, a pinned saved search, or a minimum photo quality.
That box is keyword search over the tags behind Tagrly's AI photo search. In Tagrly's own testing on a 5,000-photo set, focal-subject tagging surfaced the correct top match in roughly 9 of 10 searches.
Warning. A library link with nothing narrowed shows your whole library, minus hidden photos. Narrow it per client and check it in a private window first.
Controls depend on the plan:
- Every plan, free included. An expiry date, downloads on or off, an on/off switch for the link, and your workspace logo.
- Pro and Business. A password, an email gate and client favorites. Business also drops the "Made with Tagrly" line.
The password gates the photos, not just the page: the gallery and every photo and thumbnail load through the share link, which checks the password or email gate, the on/off switch and the expiry date before handing over each photo. The page never shows a raw file address, and password guesses are rate-limited.
The email gate is self-reported: Tagrly checks the address is well formed and its domain accepts mail, but sends no code to prove the viewer owns it. The link's analytics page logs views, favorites, downloads and searches against it.
What happens when you change the password or switch the link off
A new password keeps out future visitors, switching the link off stops people already inside, and nothing recalls a photo someone already saved.
If a gallery page points at raw public file addresses, a copied address keeps loading the photo after any change. If photos load through the share link, switching it off stops new loads. In Tagrly:
- Change the password. New visitors need it. Anyone who entered the old one stays signed in to that link in their browser.
- Switch the link off, set its expiry to now, or delete it. The gallery and any new photo loads stop for everyone, signed in or not.
Note. A photo a viewer already loaded, or a photo address someone copied, can keep working from the browser's or the network's cache for up to a day after you switch a link off. No web gallery can recall a photo someone downloaded or screenshotted.
To test any tool, copy a photo's image address from your shared gallery, switch the link off, and try it in a private window two days later. If it still loads, the switch never reached the photos.
Which password protected photo gallery fits you
The right setup turns on who the client is and whether they come back with questions.
- One Google-account client, occasional deliveries. Pick Drive's Restricted sharing: free, and a named account beats a password.
- You already pay for Dropbox Professional or a business plan. Pick a passworded, expiring Dropbox link.
- Shoots where the gallery is the product. Pick a proofing gallery like ShootProof, SmugMug or Pic-Time.
- An archive clients query month after month. Pick a catalog link narrowed per client, with the password on Pro. Tagrly is one option.
- A whole-library handoff at contract end. Skip the gallery; see how to send a photo library to a client.
A password protected photo gallery for clients is easy to get in 2026; what differs is what the password gates and what the off switch stops. To judge the catalog route, start with your own photos: the first 500 are free, no credit card. Every link gets an expiry date, a downloads switch and an off switch, and the password and email gate come with Pro and Business. Our guide to finding any photo in your library covers making a big library findable first.
Frequently asked questions
Can you put a password on a Google Drive share link?
No. Google Drive links have two general access settings, Restricted and Anyone with the link, and neither takes a password. Restricted is the closest control: only people you name can open the link, and they sign in with a Google account to do it. Drive's Add expiration option works per named person and only on work and school accounts, with folders limited to Viewer access and a date within one year; admins on those accounts may also block sharing outside the organization. A personal Google account gets neither a link password nor an expiry. Google Photos links take no password either, since anyone with the link can view the photos. If a password matters and your photos live in Drive, use a gallery tool that connects to Drive and adds its own password, a paid Dropbox plan, or a proofing gallery.
Do Dropbox shared links support passwords?
Yes, on paid plans. Dropbox lists link passwords and link expiry for Professional, Essentials, Standard, Advanced, Business, Business Plus and Enterprise, so the free Basic plan, Plus and Family do not include them. An expiring link stops at 11:59 pm on the chosen day, in your time zone. Two caveats before you promise a client a locked link. First, link settings apply only to people who open the folder through the shared link; anyone you added directly, or who already had access, keeps their existing permissions. Second, a password protected Dropbox link still opens into a file browser, so the client lands on filenames and folders, not a presented gallery.
Is a password enough to keep a client photo gallery private?
A password stops casual forwarding, and that is most of what it does. The password usually travels in the same email or text as the link, so anyone who gets the whole message gets both. Make it strong: ShootProof's security guide suggests at least 12 characters, no client names, dates or session type, a unique password for each gallery, and a mix of cases, numbers and symbols. Then ask whether the password gates the photo files or only the gallery page, and what happens to people already inside when you change it. An email gate attaches an address to each visit, but it records whatever the viewer typed; unless the tool sends a code, it does not prove they own it. None of this is encryption, and no gallery can recall a photo someone already downloaded.
Can a password protected client gallery also be searchable?
Yes, in catalog tools where a gallery is a boundary drawn over a tagged photo library. An AI tagging pass reads every photo and records a focal subject, context tags and a line of alt text, and the pass runs unattended in the background. In Tagrly, a library link gives the client a search box that matches their words against those tags, and you narrow it to chosen collections, a pinned saved search or a minimum photo quality. Narrowing matters: a library link with nothing narrowed shows your whole library minus hidden photos. The password and email gate on that link are Pro and Business controls. Proofing galleries now search too, Pic-Time on its Advanced plan and Zenfolio with a selfie, but only inside one delivered gallery.
What happens to a shared gallery when I change or remove its password?
Removing the password lets anyone with the link in, unless another gate such as an email gate is still on. Changing it keeps new visitors out, but in Tagrly it does not sign out people already inside: a viewer who entered the old password stays signed in to that link in their browser. To cut off people who already opened the gallery, switch the link off, set its expiry date to now, or delete it. Those stop the gallery and any new photo loads for everyone, signed in or not. Photos a viewer already loaded, or a copied photo address, can keep working from the browser's or the network's cache for up to a day, and nothing recalls a photo someone downloaded or screenshotted. In tools whose gallery points at raw public file addresses, a copied address keeps working after any change, so test yours: copy a photo address, switch the link off, and try it in a private window two days later.
Can you password protect an iCloud Shared Album?
Apple's instructions show no password option. From iOS 27, Shared Albums offer sharing options to invite and approve participants, or to share the album with a link, and people can join on the web even without an Apple Account or Apple device. Approval is the closest thing to a gate: you choose who gets in rather than handing out a password. Full-resolution sharing also arrives with iOS 27, and Make Album Temporary deletes an album after 30 days, which works as a rough expiry. That suits friends and family on iPhones. For client work that needs a real password, look at a paid Dropbox plan, a proofing gallery, or a catalog link with a password.
Try Tagrly on your own photo library
Connect your Google Drive or Dropbox folder and Tagrly will tag every photo in bulk. Search by what is actually in the image, share specific shots with clients, and never lose a photo again.
- Free for your first 500 photos
- Read-only access, revoke anytime
- No credit card
