You need to show a video to specific people and keep everyone else out. A rough cut for a client, internal training, family footage, unreleased material. The instinct is right, put a password on it, but video protection has layers, and some popular methods are security theater. Here is what actually works, from casual to serious.

First, name your threat model

"Private" means different things:

Keeping out casual viewers

Unlisted links, obscurity-based protection. Sufficient for most personal sharing; anyone with the URL can watch, but nobody finds it by accident.

Controlling a known group

Password or login protection. Blocks link-forwarding to strangers, mostly.

Genuine confidentiality

Authenticated access, expiry, watermarking, and the acceptance that determined viewers with screen-recording software can always recapture a playing video.

Every method below fits a different row on that ladder. Pick the row that matches your actual risk.

Unlisted links: the honest baseline

An unlisted link means the video is not in feeds, search, or indexes, and the URL is the credential. It is the default model of link-first platforms, including short-video hosts like s.pub, where knowing the page URL is the gate. This is fine for sharing with defined groups and is what most people actually mean by "private."

Understand the failure mode: URLs leak via screenshots, browser histories, and forwards. For content where a leak is merely awkward, accept this. Where a leak is costly, read on.

Password-protected pages

Some hosting and sharing services offer per-video passwords: viewers hit a page, type the password, watch. This blocks the forwarded-link problem, strangers with the URL still need the secret.

The gotchas:

Passwords travel with the video

Share the password over a different channel than the link. If both sit in the same email, you have built an unlisted link with extra steps.

No per-viewer identity

One password shared among twenty people cannot tell you which of the twenty re-shared it. Rotate the password when someone leaves the group.

Availability varies

Check whether your platform supports it before promising the feature to a client.

Login-gated access

The stronger pattern: viewers have accounts, and access is granted per account. This is how shared-album ecosystems and corporate platforms work, and it is the right call for ongoing controlled distribution, ongoing family sharing, internal material, client portals. Per-account access enables revocation, expiry, and audit logs, the features that make protection manageable rather than aspirational.

Self-hosted options for full control

When the video must stay on your infrastructure:

Signed, expiring URLs

Generate URLs with a cryptographic signature and expiry. Anyone with the link watches until the clock runs out, then it dies. Excellent for one-time reviews and demos. Object storage platforms support this natively with a few lines of code.

Basic auth or SSO in front

Password or single-sign-on gate on the path serving the video. Works, but protect the stream and the player page both, or the media URL leaks around your gate.

Watermarking

Overlay the viewer's identity, email, or ID subtly in the video. It does not prevent capture, but it powerfully discourages redistribution, because leaks trace back. Combined with per-account access, this is the practical ceiling of video protection for distributed viewing.

The hard truth about DRM

Hollywood-grade DRM exists and can be licensed. It raises the bar against casual copying. It also adds cost, complexity, and player restrictions, and it still does not defeat a camera pointed at a screen. For nearly every individual or small-team use case, signed links plus per-account access plus watermarking achieves the realistic goal: making leaks traceable and unattractive, rather than impossible.

A decision shortcut

Casual sharing with people you trust: unlisted link, done. Defined group, low stakes if forwarded: password page, password shared separately. Ongoing controlled distribution: login-gated access. One-time sensitive review: signed expiring link. Leak would genuinely hurt: per-account access with watermarking, and a frank conversation about who really needs to see it.

Choose the lightest tool that covers your actual risk, share secrets on channels separate from links, and set expiry dates by default. Access you can revoke is access you control.