---
url: /private-html-hosting
title: Private HTML Hosting – Four Levels of Access, Compared
updatedAt: "2026-10-14"
description: "Private HTML hosting serves a page only to the people it is for. Four levels, from an unguessable URL to company sign-in, compared on forwarding, per-person removal and a record of who opened the page."
---
# Private HTML hosting that only your team can open.
Four levels of access, from an unguessable URL to company sign-in. Compare what each level stops, then pick the level that fits the page.
[Publish a private page free →](https://app.display.dev) · [See pricing](/pricing)
---
## What is private HTML hosting?
Private HTML hosting serves an HTML page only to the people it is for. There are four levels. An unguessable URL hides the page from search, but anyone with the link gets in. A shared password adds a secret that travels with the link. An email check lets in anyone who proves an address at a domain you chose. Company sign-in checks the Google, Microsoft or SAML identity of each reader, so you can remove one person.
Display (display.dev), the docs workspace for agents and people, works at the fourth level and also invites single readers by email. Stacktree works at the first three levels and adds end-to-end encryption.
> **Info:** **Checked on 14 October 2026.** The statements about Stacktree, Vercel, Netlify and Cloudflare come from their own documentation and pricing pages on that date. The statements about Display come from our own documentation.
---
## The four levels compared
| Level | Who can open the page | Safe when someone forwards the link? | Remove one person? | Record of who opened it |
| ---------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------ | ---------------------------------------- | -------------------------------------------------------------------------------------------------- |
| **1. Unguessable URL** | Anyone who has the link | No. Whoever gets the link gets in | No. You replace the URL for everyone | None, other than page analytics |
| **2. Shared password** | Anyone who has the link and the password | No. People forward both together | No. You change the password for everyone | None |
| **3. Email check** | A reader who proves an address at a domain you chose | Partly. The link alone opens nothing, but anyone on the allowed domain gets in | By domain, not by person, on most hosts | Depends on the host |
| **4. Company sign-in** | Each reader signs in with their own Google, Microsoft or SAML identity | Yes. The link alone opens nothing | Yes. Remove the person | Yes, on hosts that record viewers. Display Pro gives view counts, viewer identity and an audit log |
The column "Safe when someone forwards the link" asks one question. If the first reader sends the link to a stranger, can the stranger open the page? Each level adds one property. No level keeps a page safe if a reader copies the content.
---
## Where Display and Stacktree sit
**Display.** Public, Company and Private. A Private artifact opens for you and the people you invite. Each invited reader enters their email address and a one-time password (OTP) that Display sends. A Company artifact opens for the members of your organization after they sign in. Google and Microsoft sign-in is on Pro. SAML is an Enterprise item, set up by contract. Display has no shared-password mode and no expiring links.
**Stacktree.** Its pricing page lists a passcode gate and end-to-end encryption on every plan. The email-domain gate starts on Solo ($19 a month). Free pages expire after 7 days. Stacktree states that the encryption key stays in the URL fragment, so its server stores data that it cannot read.
---
## Why agent output made this a category
Agents now write reports, plans, dashboards and prototypes as HTML files. These files hold customer names, numbers and plans that are not public. The usual places for them are a chat window, a local folder or a public link. None of these places is good for a file that a client or a whole company must read. Teams need a place that keeps the file, gives it one URL and controls who can open it. We call this [gated publishing](/blog/what-is-gated-publishing). Most people search for it as private HTML hosting.
---
## What to look for in a host
1. **Checks on the server.** The host must not send the page until it grants access. A JavaScript prompt does not do this. Read [how to password-protect an HTML page](/blog/password-protect-html-file).
2. **Access for each person.** You must be able to add and remove one reader.
3. **A record of who opened the page.** Ask what the host records and for how long.
4. **Outside readers.** Find out if a client without an account can open the page, and how.
5. **The same URL for each version.** A new version must appear at the same address.
6. **Publishing from your tools.** Look for a CLI, an API or MCP tools, so that an agent can publish.
7. **Clear limits.** Check the size limits, the retention and what happens to a free page.
8. **Previews and old URLs.** On deploy platforms, make sure that the previews and old deployments have protection too.
---
## How to choose a level
| Your situation | Pick |
| ----------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| A low-risk page for one person, one time | Level 1 or 2 on any host |
| A short review with a small group who can share a secret | Level 2: Vercel Password Protection ($20 a month per project on Pro), a Netlify password (Pro plans) or a Stacktree passcode |
| A client or partner who needs access for weeks, and removal later | Level 3 or 4 with an invitation for each person: Display, or Cloudflare Access |
| A page that only your company can open | Level 4: company sign-in |
| Content that the host itself must not read | End-to-end encryption: Stacktree, or a tool that encrypts in the browser, such as StatiCrypt |
| A link that expires or opens only one time | Stacktree. Display has no expiring links |
| An application that runs code | The protection feature of your deploy platform |
---
## Who can open a Display page
**Anyone with the link.** A Public artifact opens for anyone, with no sign-in. Use it only for pages that anyone can read.
**Invited people.** A Private artifact opens for you and the email addresses you invite. A client enters a one-time password and needs no account.
**Everyone at your company.** A Company artifact opens for the members of your organization after they sign in with Google, Microsoft or a one-time password.
**An Owner sets the limits.** An Owner can restrict Public artifacts or outside sharing for the whole organization.
---
## Publish a private page on Display
**Connect your agent.** Connect Cursor, Codex, Claude Code or any other agent to Display.
**Ask for a private page.** Tell the agent: "Publish ./report.html to Display as a private artifact named Q3 report, and invite [alice@client.com](mailto:alice@client.com). Return the link."
**Or ask for a company page.** Tell the agent: "Publish ./report.html to Display for my company."
**Change the audience later.** Ask the agent to make the Q3 report visible to your company. To remove a reader, ask the agent to stop sharing the report with [alice@client.com](mailto:alice@client.com).
---
## Where Display is not the right tool
**You want a password and nothing more.** Display has no shared-password mode.
**You want a link that expires.** Display has no expiring links, and no release date for them.
**You want end-to-end encryption.** Display stores your file and can read it.
**You publish a whole site.** Display serves one HTML or Markdown file for each artifact. Publishing a directory or a ZIP file is on the roadmap.
**You need outside guests to comment.** Guests can view a page. They cannot comment yet.
**You need a self-serve custom domain.** Custom domains are not self-serve. They are an Enterprise item, set up by contract.
---
## Pricing
**Free** – €0. 3 gated artifacts, unlimited public artifacts, one-time password sign-in, unlimited viewers.
**Solo** – €15/mo. Unlimited gated artifacts, 1GB storage, version history.
**Pro** – €49/mo. Google and Microsoft sign-in, view counts and viewer identity, 90-day audit log.
**Enterprise** – from €499/mo. SAML by contract, 365-day audit log, DPA and SLA.
Every plan has unlimited viewers, with no fee. Prices exclude VAT.
[See all pricing →](/pricing)
---
## What teams say
> "Before display.dev, we were sharing artifact files with each other in Slack and putting our comments there."
>
> – Max Wood, CEO, Indigo Engineering. [Read the story →](/customers/indigo-engineering)
---
## Related reading
- [How to password-protect an HTML page](/blog/password-protect-html-file)
- [What is gated publishing?](/blog/what-is-gated-publishing)
- [Stacktree alternative](/stacktree-alternative)
- [Where to host AI-generated HTML](/blog/where-to-host-ai-generated-html)
---
## Try Display free
- 3 private or company pages on Free, with unlimited viewers
- Invite a client by email. The client needs no account
- Any agent publishes: Cursor, Codex, Claude Code or any other agent
[Publish a private page free →](https://app.display.dev) · [See all pricing](/pricing)
---
## FAQ
**What is private HTML hosting?**
Hosting for an HTML page that only chosen people can open. The host checks the identity of the reader, or a secret, before it sends the page.
**Is an unguessable URL private?**
It is private from search engines and from people who do not have the link. It is not private from a person who gets the link. Use it only for low-risk pages.
**Is a password enough to keep a page private?**
For a short review with a few trusted people, yes. But a password travels with the link, you cannot remove one reader, and you get no record of who opened the page.
**What is the difference between an email check and company sign-in?**
An email check proves that a reader controls an address at an allowed domain. Company sign-in checks the Google, Microsoft or SAML account of the reader. Both stop a stranger who has the link. Sign-in connects access and a record to one person.
**Does Display support SAML?**
SAML (for example, Okta) is part of the Enterprise plan, set up by contract. Google and Microsoft sign-in is on Pro.
**Can I share a private page with someone outside my company?**
Yes. Invite their email address. They enter an OTP that Display sends to that address, and they need no account. They can view the page. They cannot comment yet. An Owner can restrict Public artifacts or outside sharing for the whole organization.
**Can an agent publish a private page?**
Yes. Connect Cursor, Codex or Claude Code to the Display CLI or MCP server. The agent publishes the file and sets the access level. You can also publish without an account. You get a public preview for 30 days and a claim URL. After you claim the artifact, change its audience to Private.
**Who can see my file on Display?**
Display stores the file and sends it only to the audience you choose. Display does not have end-to-end encryption. Read the [security page](/security) to learn how Display controls access.