The origin URL never reaches the browser
Content streams through a server-side proxy at /api/proxy. The URL you pasted stays on the server, so a recipient cannot forward the original to anyone, or keep it after you pull the link.
LinkUr
Protected sharing
A link you can still take back.
LinkUr wraps a link you already have: a password in front, the real URL hidden behind a proxy, and a line in the log for every open. Change your mind at any point and it stops working.
Free while it is in Phase 1. No card, no plans, no seats.
How it works
Three steps, and the last one never really ends.
- 1
Paste a URL you already have
Point LinkUr at something you host elsewhere: Drive, S3, Notion, your own server. Set a primary password and a fallback one. Add an expiry date or an open limit if you want them.
- 2
Send the short link
Your recipient gets linkur.in/l/xxxxxx and nothing else. They type the password in the browser. No account, no app, no extension.
- 3
Watch, then decide
Every open writes a row: time, coarse location, device, result. Unusual patterns get flagged. If something looks wrong, you lock it, rotate the password, or revoke it for good.
Under the hood
Four things a password alone does not give you.
Thirty-second content tokens, bound to the session
Each stream is authorised by a signed token that expires in 30 seconds and only works for the access session that earned it. A copied request is dead on arrival.
A fallback password you set in advance
Every link takes a primary and a fallback password. Both unlock it today. When you rotate the primary, the fallback is already in the hands of the person who needs it.
Revoke is immediate and permanent
Revoking blocks the proxy for everyone, including sessions that are already open. There is no grace period and no undo, which is the point.
What gets flagged
Published thresholds, not a black box.
Every rule that raises a flag is listed here with the number behind it. When a flag fires you get the row, the reason, and a suggested next move. What you do about it is yours to decide.
FlagRule
- Many IPs3 or more distinct IPs inside a 15-minute window
- Impossible travelLocation changes in a way 30 minutes cannot explain
- Rapid failures5 or more wrong passwords inside 5 minutes
- New deviceA fingerprint that has never opened this link before
Read this before you sign up
What LinkUr does not do.
It does not stop screenshots, photos of a screen, or downloads. Anything a person can read, a person can copy. LinkUr tells you it happened; it cannot prevent it.
It protects links, not files. There is no upload, so whatever you are sharing has to be hosted somewhere already.
Flags warn you. They do not act on their own. Nothing locks or revokes automatically yet, so the decision stays with you.
There is no password reset for your own account yet. Lose it and you lose the account.
Link settings are fixed after creation. Wrong expiry means a new link.
One owner per account. No teams, no shared workspaces, no billing.
Questions
The four people usually ask.
Can the recipient find the original URL?
Not from the browser. Content is streamed through the proxy, so the network tab shows /api/proxy and never the address you pasted. They can still save what they are shown, which is a different problem and one nobody solves.
Does the recipient need an account?
No. They open the link, type the password, and read it. Their access session lasts an hour, after which the password is needed again.
What exactly gets logged?
Timestamp, IP, coarse location from that IP, a device fingerprint, and whether the attempt succeeded. The link detail page shows the most recent 200 events on a list and a map.
What happens when I hit revoke?
The link stops serving content immediately, including to sessions that are already unlocked. It cannot be brought back. If you only want to pause it, lock it instead.
Put the next sensitive link on a leash.
Takes under a minute to make your first protected link. Nothing to install on either end.