Password Protection for Stashes

#

Password protection adds an extra layer of security to your stashes, ensuring only people with the password can access them—even if they have the URL.

Why Use Password Protection?

#

Password protection is useful when you want to:

• Share selectively — Give access only to specific people
• Add security to private stashes — Extra protection for sensitive content
• Control access — Revoke access by changing the password
• Share work-in-progress — Let collaborators view before going public
• Protect sensitive resources — Keep personal or confidential links secure

How Password Protection Works

#

Access Flow

#

1. Visitor arrives at your password-protected stash URL
2. Login screen appears — They must enter the password
3. Password is verified — System checks against stored hash
4. Access granted — They can view the stash contents
5. Session persists — They remain logged in for that stash

Security Features

#

• Passwords are hashed — Never stored in plain text
• HTTPS encryption — All transmissions are encrypted
• Session-based access — Users don’t need to re-enter password every visit
• No brute force — Rate limiting prevents guessing attacks

Setting Up Password Protection

#

Step 1: Open Stash Settings

#

Navigate to your stash and click the Settings (gear) icon.

Step 2: Enable Password Protection

#

Find the Password Protection section and toggle it On.

Step 3: Generate or Create Password

#

Auto-Generated Password (Recommended)

#

• Click Generate Password
• A strong, random password is created
• The password is shown once with a QR code
• Download or copy it immediately

Custom Password

#

• Choose Create Custom Password
• Enter your own password
• Must meet minimum requirements (usually 8+ characters)
• Confirm the password

Step 4: Save Settings

#

Click Save or Enable Protection to activate.

Understanding “Shown Once” Security

#

Why Passwords Are Only Shown Once

#

For security reasons, passwords are displayed only once when first generated or regenerated:

1. Security Best Practice — Reduces risk of unauthorized viewing
2. Prevents Accidental Exposure — Others can’t see the password later
3. Encourages Secure Storage — You’ll save it properly the first time

What Happens After Initial Display

#

After you close the password dialog:

• The password is masked in settings (shows as ••••••••)
• You cannot reveal the existing password
• You can still regenerate a new password anytime
• The current password continues working for access

If You Forget the Password

#

You have two options:

Option 1: Regenerate Password

#

1. Go to stash settings
2. Click Regenerate Password
3. A new password is created
4. Old password stops working immediately
5. Share the new password with authorized users

Option 2: Remove Protection

#

1. Go to stash settings
2. Toggle Password Protection off
3. Save changes
4. Stash is now accessible without password
5. You can re-enable with a new password later

Sharing the Password

#

Method 1: QR Code (Recommended)

#

When you generate a password, a QR code is displayed:

To share:

1. Take a screenshot of the QR code
2. Send the image to authorized users
3. They scan it to get the password

Benefits:

• Quick and easy sharing
• No typing errors
• Works great on mobile
• Can be saved offline

Method 2: Download QR Code

#

Click Download QR Code to save as an image file:

• Save to your device
• Email or message the file
• Print for physical distribution
• Store in password manager

Method 3: Copy Password

#

Click the Copy button to copy the password:

• Paste in secure messaging apps
• Share via encrypted channels
• Store in password manager
• Don’t share in plain text on insecure channels

Best Practices for Password Sharing

#

✅ Do

#

• Use secure channels (Signal, WhatsApp, encrypted email)
• Share QR codes instead of plain text passwords
• Use a password manager to store passwords
• Regenerate passwords periodically
• Revoke access by changing passwords when needed

❌ Don’t

#

• Post passwords in public channels
• Share via unencrypted email
• Write passwords on sticky notes
• Share the same password across multiple stashes
• Forget to update collaborators when regenerating

Managing Password Access

#

Checking Who Has Access

#

Currently, Stashed doesn’t show a list of who has accessed your stash. The password can be shared with anyone you choose.

Revoking Access

#

To revoke access:

1. Regenerate the password — Old password stops working
2. Notify authorized users — Share the new password
3. Remove from public places — Delete any posted passwords

Multiple Stashes, Same Password?

#

Not recommended. Use unique passwords for each stash so compromising one doesn’t affect others.

Password Requirements

#

Auto-Generated Passwords

#

• 16+ characters
• Mix of uppercase, lowercase, numbers, symbols
• Cryptographically random
• High entropy (hard to guess)

Custom Password Requirements

#

• Minimum 8 characters (recommended 12+)
• At least one uppercase letter
• At least one lowercase letter
• At least one number
• At least one special character (recommended)

Weak Passwords

#

If you choose a weak password, you’ll see a warning. Consider using the auto-generated option for better security.

Troubleshooting

#

Password Not Working?

#

• Check for typos (passwords are case-sensitive)
• Ensure no extra spaces
• Try copying and pasting directly
• Clear browser cache and try again
• Regenerate the password if needed

Can’t Generate Password?

#

• Check your internet connection
• Refresh the page
• Ensure you’re the stash owner
• Try a different browser

QR Code Not Scanning?

#

• Ensure good lighting
• Hold camera steady
• Clean your camera lens
• Try a different QR scanner app
• Download and share the password directly instead

Accidentally Closed Password Dialog?

#

• The password is now masked for security
• Click Regenerate Password to create a new one
• The old password still works until regenerated

Security Considerations

#

What Password Protection Does

#

• ✅ Requires password to view stash content
• ✅ Encrypts password in database
• ✅ Uses secure session management
• ✅ Prevents unauthorized access

What Password Protection Doesn’t Do

#

• ❌ Doesn’t encrypt the stash data itself
• ❌ Doesn’t prevent screenshotting
• ❌ Doesn’t stop password sharing
• ❌ Doesn’t hide the stash title/description (only content)

For Maximum Security

#

• Use strong, unique passwords
• Share passwords securely
• Combine with private stash visibility
• Regularly rotate passwords
• Monitor for unauthorized access

Next Steps

#

Learn more about secure sharing:

• QR Code Password Sharing
• Privacy & Visibility Options

Quick Reference

#