What private HTML hosting is, and how to choose a level
Private HTML hosting
that only your team can open.
Four levels of access, from an unguessable URL to company sign-in. Compare what each level stops, then pick the level that fits the page.
The demo shows an agent publishing a doc to display.dev – from a chat or a terminal – then a teammate opening its URL, selecting Edit, changing a number on the page and saving v2, a colleague commenting on v2, the agent publishing v3 at the same URL and resolving the comment, and the doc being shared with someone outside the company.
Cursor, Codex, Claude Code – any agent that writes a file. Switch agents anytime – your URLs, versions and comments stay put.
Used by top teams at
What is private HTML hosting?
Private HTML hosting serves an HTML page only to the people it is for. There are four levels. An unguessable URL hides the page from search, but anyone with the link gets in. A shared password adds a secret that travels with the link. An email check lets in anyone who proves an address at a domain you chose. Company sign-in checks the Google, Microsoft or SAML identity of each reader, so you can remove one person.
Display (display.dev), the docs workspace for agents and people, works at the fourth level and also invites single readers by email. Stacktree works at the first three levels and adds end-to-end encryption.
The four levels compared
| Level | Who can open the page | Safe when someone forwards the link? | Remove one person? | Record of who opened it |
|---|---|---|---|---|
| 1. Unguessable URL | Anyone who has the link | No. Whoever gets the link gets in | No. You replace the URL for everyone | None, other than page analytics |
| 2. Shared password | Anyone who has the link and the password | No. People forward both together | No. You change the password for everyone | None |
| 3. Email check | A reader who proves an address at a domain you chose | Partly. The link alone opens nothing, but anyone on the allowed domain gets in | By domain, not by person, on most hosts | Depends on the host |
| 4. Company sign-in | Each reader signs in with their own Google, Microsoft or SAML identity | Yes. The link alone opens nothing | Yes. Remove the person | Yes, on hosts that record viewers. Display Pro gives view counts, viewer identity and an audit log |
The column "Safe when someone forwards the link" asks one question. If the first reader sends the link to a stranger, can the stranger open the page? Each level adds one property. No level keeps a page safe if a reader copies the content.
Where Display and Stacktree sit
- Display
- Public, Company and Private. A Private artifact opens for you and the people you invite. Each invited reader enters their email address and a one-time password (OTP) that Display sends. A Company artifact opens for the members of your organization after they sign in. Google and Microsoft sign-in is on Pro. SAML is an Enterprise item, set up by contract. Display has no shared-password mode and no expiring links.
- Stacktree
- Its pricing page lists a passcode gate and end-to-end encryption on every plan. The email-domain gate starts on Solo ($19 a month). Free pages expire after 7 days. Stacktree states that the encryption key stays in the URL fragment, so its server stores data that it cannot read.
Why agent output made this a category
Agents now write reports, plans, dashboards and prototypes as HTML files. These files hold customer names, numbers and plans that are not public. The usual places for them are a chat window, a local folder or a public link. None of these places is good for a file that a client or a whole company must read. Teams need a place that keeps the file, gives it one URL and controls who can open it. We call this gated publishing. Most people search for it as private HTML hosting.
What to look for in a host
- Checks on the server. The host must not send the page until it grants access. A JavaScript prompt does not do this. Read how to password-protect an HTML page.
- Access for each person. You must be able to add and remove one reader.
- A record of who opened the page. Ask what the host records and for how long.
- Outside readers. Find out if a client without an account can open the page, and how.
- The same URL for each version. A new version must appear at the same address.
- Publishing from your tools. Look for a CLI, an API or MCP tools, so that an agent can publish.
- Clear limits. Check the size limits, the retention and what happens to a free page.
- Previews and old URLs. On deploy platforms, make sure that the previews and old deployments have protection too.
How to choose a level
| Your situation | Pick |
|---|---|
| A low-risk page for one person, one time | Level 1 or 2 on any host |
| A short review with a small group who can share a secret | Level 2: Vercel Password Protection ($20 a month per project on Pro), a Netlify password (Pro plans) or a Stacktree passcode |
| A client or partner who needs access for weeks, and removal later | Level 3 or 4 with an invitation for each person: Display, or Cloudflare Access |
| A page that only your company can open | Level 4: company sign-in |
| Content that the host itself must not read | End-to-end encryption: Stacktree, or a tool that encrypts in the browser, such as StatiCrypt |
| A link that expires or opens only one time | Stacktree. Display has no expiring links |
| An application that runs code | The protection feature of your deploy platform |
Who can open a Display page
A Public artifact opens for anyone, with no sign-in. Use it only for pages that anyone can read.
A Private artifact opens for you and the email addresses you invite. A client enters a one-time password and needs no account.
A Company artifact opens for the members of your organization after they sign in with Google, Microsoft or a one-time password.
An Owner sets the limits. An Owner can restrict Public artifacts or outside sharing for the whole organization.
Publish a private page on Display
Where Display is not the right tool
- You want a password and nothing more
- Display has no shared-password mode.
- You want a link that expires
- Display has no expiring links, and no release date for them.
- You want end-to-end encryption
- Display stores your file and can read it.
- You publish a whole site
- Display serves one HTML or Markdown file for each artifact. Publishing a directory or a ZIP file is on the roadmap.
- You need outside guests to comment
- Guests can view a page. They cannot comment yet.
- You need a self-serve custom domain
- Custom domains are not self-serve. They are an Enterprise item, set up by contract.
Pricing
Try it. No credit card.
- Included: 3 gated artifacts
- Included: Unlimited public artifacts*
- Included: 50MB storage
- Not included: Version history
- Not included: Google + Microsoft SSO
- Not included: Audit logs
display.dev branded
Individuals. Unlimited gated sharing.
- Included: Unlimited gated artifacts
- Included: Unlimited public artifacts
- Included: 1GB storage
- Included: 10 versions
- Not included: Google + Microsoft SSO
- Not included: Audit logs
For teams who need SSO & audit logs.
- Included: Unlimited gated artifacts
- Included: Unlimited public artifacts
- Included: 25GB storage
- Included: 50 versions
- Included: Google + Microsoft SSO
- Included: 90 days audit logs
For compliance-driven organizations.
From €499/mo
- Included: Unlimited gated artifacts
- Included: Unlimited public artifacts
- Included: Custom storage
- Included: Unlimited versions
- Included: Google + Microsoft SSO
- Included: 365 days audit logs
Every plan has unlimited viewers, with no fee. Prices exclude VAT.
What teams say
Before display.dev, we were sharing artifact files with each other in Slack and putting our comments there.Read the story
Try Display free
- 3 private or company pages on Free, with unlimited viewers
- Invite a client by email. The client needs no account
- Any agent publishes: Cursor, Codex, Claude Code or any other agent
Common questions.
What is private HTML hosting?
Hosting for an HTML page that only chosen people can open. The host checks the identity of the reader, or a secret, before it sends the page.
Is an unguessable URL private?
It is private from search engines and from people who do not have the link. It is not private from a person who gets the link. Use it only for low-risk pages.
Is a password enough to keep a page private?
For a short review with a few trusted people, yes. But a password travels with the link, you cannot remove one reader, and you get no record of who opened the page.
What is the difference between an email check and company sign-in?
An email check proves that a reader controls an address at an allowed domain. Company sign-in checks the Google, Microsoft or SAML account of the reader. Both stop a stranger who has the link. Sign-in connects access and a record to one person.
Does Display support SAML?
SAML (for example, Okta) is part of the Enterprise plan, set up by contract. Google and Microsoft sign-in is on Pro.
Can I share a private page with someone outside my company?
Yes. Invite their email address. They enter an OTP that Display sends to that address, and they need no account. They can view the page. They cannot comment yet. An Owner can restrict Public artifacts or outside sharing for the whole organization.
Can an agent publish a private page?
Yes. Connect Cursor, Codex or Claude Code to the Display CLI or MCP server. The agent publishes the file and sets the access level. You can also publish without an account. You get a public preview for 30 days and a claim URL. After you claim the artifact, change its audience to Private.
Who can see my file on Display?
Display stores the file and sends it only to the audience you choose. Display does not have end-to-end encryption. Read the security page to learn how Display controls access.
Publish your first artifact in 15 seconds.
Free tier. No credit card. One-time password auth on free, Google + Microsoft SSO on Pro (€49/month flat).