Share Link Security

Two self-serve controls, a share password and link expiry, that bound who can open a shared diagram and for how long.

A share link is a capability: anyone holding the URL has its role. That is what makes sharing frictionless, but it also means a link left lying around keeps working. livediagram gives you two controls to tighten that up, a password on the diagram and an expiry on each link. Both are set from the Share dialog, and both apply to everyone except you, the owner.

Share password

You can put a single password on a diagram. Once it is set, anyone opening any share link for that diagram must enter it before they can view, and the password rides along on every later request so writes stay gated too.

  • One password covers every link on the diagram, not one password per link.
  • You always bypass it. The owner is identified directly, so you never get prompted on your own diagram.
  • The owner can read it back. The password is shown in the clear in the Share dialog so you can hand it to people and change it later.

The goal is to stop people guessing or stumbling onto a share URL, not to provide cryptographic protection. Set, change, or remove it any time from the Share dialog's Password row. See share passwords for the full walkthrough.

When you create a share link you can give it a lifetime, so access ends automatically without you having to remember to revoke it.

| Choice | Lifetime | | -------- | ----------------------- | | Never | no expiry (the default) | | 1 Week | 7 days | | 1 Month | 30 days | | 6 Months | 183 days |

When a link expires it stops granting access everywhere at once: the share URL, the embed view, and the real-time room all behave as if the link were revoked. The expired link does not vanish, though. It moves to an "Inactive share links" section of the Share dialog, where you can delete it or Extend it to give it a fresh deadline.

Use the two together for sensitive work: a password stops casual access, and an expiry bounds how long even the right people keep it. To cut access immediately, just revoke the link.

Existing live sessions are not force-disconnected at the exact expiry moment; a visitor loses access on their next load or save. To kick someone instantly, revoke the link instead.

Was this article helpful?