Post Password Token
The Post Password Token plugin lets you issue secret urls that allow readers to access protected content without having to enter a password. It extends the default WordPress post password protection functionality by…
Consider an alternative
Post Password Token shows warning signs in 2026 — compare the alternatives below before installing. It runs on 600+ sites, is rated 4.9/5 and was last updated 3 years ago, and scores 39/100 on our health check.
- Small user base (600+ active installs)
- No update in 3 years
- Only tested up to WordPress 6.2 (latest is 7.1)
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Post Password Token stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| guest | >100 |
| pass | >100 |
| password | >100 |
| post | >100 |
| token | >100 |
Version adoption
Share of active sites per release.
Rating breakdown
★★★★★★★★★★ 4.9 from 7 reviews
About Post Password Token
From the official readme · v2.0.3Description
The Post Password Token plugin lets you issue secret urls that allow readers to access protected content without having to enter a password. It extends the default WordPress post password protection functionality by creating secret urls to the post that have an encoded token. This is similar to the guest pass functionality that can be found on Flickr.
Who is it for?
Sometimes you would like to share your blog posts with a specific group of people, but not with the wider world. For example, a family might want to blog about their adventures together for friends and family, but would rather not broadcast this to everyone. WordPress provides for this scenario by allowing you to password-protect a post. Unfortunately, we’ve found through experience that a lot of our friends never make it past the password form. Either they mis-type the password, are confused about what it is, or are simply scared off by an intimidating form.
The solution: give password-protected posts a secret url that can be shared with friends and family. The url allows your select audience to see the content without the confusion and hassle of an authentication form, while hiding the special content from search spiders and the wider-world. You can revoke secret urls at any time, so if a secret url gets to someone you don’t want it to, you can simply invalidate it.
The Details
The encoded tokens are made by taking the post-name and post-password and encoding them together. The plugin’s admin page also allows you to create a “salt”, or a unique key that makes the resulting encoded token more secure. Please note that once the salt option is set, changing it will change the secret urls for all posts. Unless you want to invalidate all of your old secret urls, it is recommended that you set the salt and leave it.
Installation
- Upload the
post-password-tokenfolder to your/wp-content/plugins/directory - Activate the plugin through the ‘Plugins’ menu in WordPress
- Configure the plugin through its Admin page to customize the parameters used to create the tokens
- When you create a password protected post you’ll have an extra post-meta box that shows the URL that you can distribute
Frequently asked questions
So, what do I have to do?
Not much. After you install the plugin all you have to do is set a password on a post using WordPress’ standard Password Protection Functionality. After the password is set and you’ve saved the post there will be a new meta box on the post edit screen (in the center content area, below the post-content editor) that will present you with a full URL to the post including the token. Distribute this URL to give people automatic access to your post.
Does the normal password functionality still work?
Yes, this still functions as normal. Accessing a password-protected post by its standard url will still show the expected password dialog, but when a reader accesses a password-protected post by its secret Password Token url, they will be automatically authenticated and be able to see the full content.
Do I have to do anything special to generate tokens for my old password-protected content?
No. Since the tokens aren’t stored but instead generated when needed there’s no need to to do anything but navigate to the post edit page for your protected post to retrieve your token.
How long does a secret url last?
The url itself lasts forever, unless you change it. Additionally, accessing a post by its secret url will set an authentication cookie for the user that lasts for 10 days.
How to I add a page anchor to my url?
If you want to deep link in to a page, you can manually add the page anchor id to the end of the url before sending out your link, ie: https://example.com/?p=5&ppt=04aa063124b672a0086fc68549a470a153b8324b776c265ff50c16640301a1f0#page-anchor
Can I have a single token for all protected content?
Not yet.
Can I set the post visibility on a per post basis?
Not yet.
How do I revoke a secret url?
If you need to revoke the secret urls for an individual post, you can simply change the post password. Once you save the post it will create new secret urls and invalidate the old ones: the old url will no longer automatically log readers in and they’ll be asked to enter a password if they use that URL. You can also revoke all secret urls site-wide (the “nuclear” option). To do so, go to the plugin admin page and change the password salt.
Does this work with caching plugins such as WP Super Cache?
Yes. The token in the URL triggers a unique cache. Be aware that this does create a potential security risk. Not huge, but potential. If you don’t want these pages cached then use the settings in your caching plugin to keep urls with ppt= in the url from being cached.
I found a bug. Where can I submit it?
If you’ve run into unexpected behavior while using the plugin, please file a bug report at https://wordpress.org/support/plugin/post-password-plugin/.
Changelog
Users can now select sha256 as a hashing algorithm, however this will obsolete existing urls. If you need backward compatability then continue using md5 as your hashing algorithm.
2.0.3
- Fixed bug where protected posts weren’t being filtered from
get_posts, thus showing up inwp:navigationblocks.
**get_postsstill has no fine grained filters, so this update feels a bit heavy. - Deprecated support for WP < 5.7
2.0.2
- Fixed a bug where the PPT Meta Box code would error on internal configuration pages where the Post wasn’t completely formed
- Fix donation button application ID
2.0.1
- Include vendor directory to support autoloading
** A new autoloading scheme will be used in the future to avoid committing the vendor directory
2.0.0
- Fixes and updates to support WordPress 5.9
- Fixes and updates to support PHP 7.4+
- Support
sha256as a hashing algorithm (default for new installs, old installs can upgrade from md5) - Moderinized plugin code
1.2.4
- Fixed a bug that would use the wrong plugins_url when plugin was installed automatically via the wordpress admin
- Show post short url in the Post edit interface
- Removing reference to WP Help Center in contextual help
- General code cleanup
1.2.3
- Updated Post Password cookie with new hashed password for WP >= 3.4
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Post Password Token alternatives
All guest plugins →
FAQ
Post Password Token: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Sep 27, 2026
Is Post Password Token free?
Yes. Post Password Token is free to download and use from the official WordPress.org plugin directory.
Is Post Password Token safe to use in 2026?
Post Password Token shows warning signs in 2026 — compare the alternatives below before installing. It runs on 600+ sites, is rated 4.9/5 and was last updated 3 years ago, and scores 39/100 on our health check.
How many websites use Post Password Token?
Post Password Token is active on 600+ WordPress websites and has been downloaded 18,687 times since it launched in September 2009. It was downloaded 181 times in the last 30 days.
Does Post Password Token work with WordPress 7.1?
Post Password Token is officially tested up to WordPress 6.2.13, while the latest release is 7.1.2. It may still work, but try it on a staging site first.
What PHP version does Post Password Token need?
Post Password Token requires PHP 7.4 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was Post Password Token last updated?
The latest version, 2.0.3, was released on July 6, 2023 (3 years ago).
Who makes Post Password Token?
Post Password Token is developed and maintained by Shawn Parker.
What are the best alternatives to Post Password Token?
The most popular alternatives to Post Password Token are Guest Author (5K+ installs), User Switcher (100+ installs) and Hide/Unhide Menu for Guest/… (40+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
