How to securely share your AI work online

Once you build a report, dashboard, one-pager or small app with ChatGPT, Claude or Cursor, you need to figure out how to securely share your AI work online. Every host gives you a link in about a minute, so the real work is making sure only the right people can open it and giving them a way to do more than just read. If you only want the share button inside your chat tool, read our companion guide on sharing straight from ChatGPT and Claude.

Most quick links are either public or require everyone to use the same tool. When you want to host an HTML file from ChatGPT or password protect a page made with ChatGPT or Claude at your own link, start by saving your AI output in a folder with the main file named index.html.

Part 1

Put your page online

Static hosts take a folder of files and give you an HTTPS link. Here are the simplest ways to deploy on Netlify, Vercel and Google, starting with browser drops and followed by command-line steps.

Netlify

1. Prepare your folder. Put your index.html file and any assets into one output folder.
2. Drop the folder. Drag your output folder onto Netlify Drop at https://app.netlify.com/drop and it goes live at a unique web address with no account needed to start.
3. Claim the site. Sign in or create an account later to claim and keep the site.

With the command line, run npm install -g netlify-cli, then netlify login, then netlify deploy for a draft and netlify deploy --prod to go live (or connect a Git repository so every push redeploys). The $0 Free plan includes custom domains with SSL and a hard limit of 300 credits a month, where bandwidth costs 20 credits per GB and each production deploy costs 15 credits (roughly 15 GB of traffic if nothing else is used). When credits run out on Netlify's Free plan, all projects pause until the next cycle or an upgrade; Personal is $9 a month and Pro starts at $20 a month.

Vercel

1. Open Vercel Drop. Sign in to your Vercel account and open https://vercel.com/drop.
2. Upload your files. Drop a file, folder or .zip, pick a team and project name, and deploy to production.
3. Update when needed. Drop new files onto the project in the dashboard to update it.

From the terminal, run npm i -g vercel, vercel login, then vercel for a preview and vercel deploy --prod for production, or connect Git so every push gets a preview deployment. The free Hobby plan includes 100 GB of data transfer and 200 projects, but it is for non-commercial personal use only: no deployments for anyone's financial gain, including work a paid employee or consultant does. Check the non-commercial rule before putting work projects on a free Hobby account.

Google (Firebase Hosting and Cloud Run)

1. Install and sign in. Run npm install -g firebase-tools, then firebase login.
2. Initialize hosting. Run firebase init hosting (the public folder defaults to public).
3. Deploy. Run firebase deploy --only hosting and the site goes live at PROJECT_ID.web.app.

The Firebase Spark (free) plan includes 10 GB storage, 360 MB a day of transfer, and a custom domain with SSL. For apps that need a server, Cloud Run (Google Cloud) runs your code or container and can admit only signed-in users through Google's Identity-Aware Proxy.

Part 2

Lock it down so only the right people can open it

Once your page is online, anyone with the link can open it unless you put a check in front of the site.

1. Use the host's built-in protection

Turning on a setting in your host's dashboard is the fastest way to lock a site, depending on your plan:

• Netlify site password: Available on the Pro plan only (not on Free or Personal). Go to Project configuration, then General, then Visitor access, then Project visibility, then Edit visibility, then Password.
• Vercel Authentication: Available on all plans under Settings, then Deployment Protection. Visitors must log in with a Vercel account that has access, and Hobby allows one external user.
• Vercel Password Protection: Available on the Pro plan only for $20 a month per protected project (not on Hobby). In Settings, then Deployment Protection, "Standard Protection" leaves production domains open, so choose "All Deployments" to protect production too.
• Firebase Hosting: Has no built-in password or sign-in setting.

2. Run your own password check on the server

When you ask an AI to password protect a page, it often puts a password check inside the page's HTML or JavaScript.

You can run a server check on Netlify and Vercel using HTTP Basic Auth, where the browser shows its own sign-in box. Basic Auth only encodes the password, so the site must use HTTPS (Netlify and Vercel sites do by default). Browser Basic Auth boxes look plain, but they stop the page from downloading until you sign in.

Keep the password in environment variables on the host (SITE_USER and SITE_PASSWORD), never in the code, and use plain letters and numbers in the password. You deploy these samples with the command line or Git.

On Netlify (Edge Function):

1. Set environment variables. Set SITE_USER and SITE_PASSWORD in the site's environment variables with a scope that includes Functions.
2. Add the edge function. Save the code below at netlify/edge-functions/password.js.
3. Redeploy. Redeploy your site with the CLI or Git (edge function calls count toward your credits).

// netlify/edge-functions/password.js
export default async (request) => {
  const user = Netlify.env.get("SITE_USER");
  const pass = Netlify.env.get("SITE_PASSWORD");
  const expected = "Basic " + btoa(`${user}:${pass}`);
  if (user && pass && request.headers.get("authorization") === expected) {
    return; // continue to the page
  }
  return new Response("Password required", {
    status: 401,
    headers: { "WWW-Authenticate": 'Basic realm="Private", charset="UTF-8"' },
  });
};

export const config = { path: "/*" };

On Vercel (Routing Middleware):

Vercel Routing Middleware works on all plans and with any framework. Vercel describes middleware as a workaround on Hobby that does not cover everything its built-in protection covers.

1. Prepare your package file. Without a framework, add "type": "module" to package.json and install @vercel/functions.
2. Set environment variables. Set SITE_USER and SITE_PASSWORD in the project's environment variables.
3. Add middleware and deploy. Put middleware.js at the project root, next to package.json, so it runs on every request, then deploy with the CLI or Git.

// middleware.js
import { next } from '@vercel/functions';

export default function middleware(request) {
  const user = process.env.SITE_USER;
  const pass = process.env.SITE_PASSWORD;
  const expected = 'Basic ' + btoa(`${user}:${pass}`);
  if (user && pass && request.headers.get('authorization') === expected) {
    return next();
  }
  return new Response('Password required', {
    status: 401,
    headers: { 'WWW-Authenticate': 'Basic realm="Private", charset="UTF-8"' },
  });
}

3. Clerk, for real sign-in accounts

When you want individual accounts instead of a shared password, Clerk gives you prebuilt sign-up, sign-in and profile pages hosted by Clerk (its Account Portal). The Free Hobby plan covers 50,000 monthly retained users per app, and "Require invitations" is included so only people you invite can sign up. Pro is $25 a month.

Clerk can be added to a plain HTML page with a script tag, but then it runs only in the browser, which has the same weakness as a password in the page's own JavaScript. Real protection with Clerk needs a server framework such as Next.js.

1. Initialize Clerk. Run npx -y clerk@latest init in Next.js to add your keys and a middleware file with clerkMiddleware().
2. Protect the page. Having clerkMiddleware() alone blocks nothing; call auth.protect() on each page you want to lock.
3. Require invitations. Turn on "Require invitations" in Clerk so only invited users can create accounts.

// app/page.tsx
import { auth } from '@clerk/nextjs/server'
export default async function Page() {
  await auth.protect() // signed-out visitors go to sign-in
  return <h1>Hello world</h1>
}

4. Cloudflare Access, a sign-in gate in front of any site

Cloudflare Access is the most technical option: it puts a sign-in gate in front of any site, wherever it is hosted. It is free for up to 50 users, then $7 per user per month (billed annually), and your domain must be active in your Cloudflare account.

1. Add your application. In Zero Trust, go to Access controls, then Applications, and add a self-hosted application with your hostname.
2. Set an Allow policy. Add an Allow policy for specific emails or every email ending in your company domain; everyone else is denied by default.
3. Choose sign-in methods. Pick your sign-in methods, such as a one-time PIN sent by email (it expires after 10 minutes), Google login, or Microsoft Entra ID.

Compare the protection options

Each option trades off setup effort, how visitors sign in, and monthly cost.

Make a protected page collaborative and multiplayer

A protected page on a static host is still read-only. Reviewers cannot comment on a sentence, suggest an edit, or get the AI to apply their feedback, so comments end up scattered in chat threads while you manually redeploy files.

This is where SecondPage fits. (Disclosure: SecondPage is our product, and you are reading a SecondPage page.) For a real app with its own backend, sign-in and custom domain, a developer host plus Clerk or Cloudflare Access is the right tool. SecondPage fits when the thing is a page people need to review, comment on and update with their AI, without setup. Use a developer host for full apps, and SecondPage when the job is reviewing and revising a page.

You can publish by uploading files or a folder yourself, or by asking a connected AI: "Publish this as a page, and keep it private until I review it." SecondPage connects to Claude, ChatGPT, Codex, Gemini, Muse, Cursor and other agents that support custom MCP connectors (the connector address is https://mcp.secondpage.cc/mcp, and you sign in once).

Access can be Restricted (only people you add), Your organization, or Anyone with the link (which opens for visitors with no account). New pages default to Your organization, and if you are unsure, start with Restricted; an AI can narrow access, but widening it needs a person to confirm. You invite people by email as viewers, commenters or editors, and someone without access can sign in with a verified email and request it.

Reviewers leave comments or anchored edits right on the page. Mentioning Turner (SecondPage's built-in AI assistant) applies a change, or your own AI reads the comments and publishes an update. Revisions keep the same link, and version history lists publishes, access changes and Turner updates. The Starter plan is free, with 30-day page availability; Pro and Custom are paid upgrades, and custom domains need Pro or Custom.

Before you share anything

• Check the page and source for unintended details. AI output can repeat names, numbers or details you did not mean to share.
• Keep passwords out of browser code. A password in client-side JavaScript is downloaded with the page, so anyone who uses View Source can read it. Keep credentials in server environment variables.
• Test in a private window. Open the production link while signed out of your host to verify the gate blocks access.
• Remember that gates do not stop copying. A link can be forwarded, and while a password or sign-in gate controls who gets in, anyone who gets in can still copy or screenshot the page.