No. An HTML file is plain text, and whoever has it can change it. What obfuscation, blocking right-click and converting to PDF each stop and don't stop, why sending a link instead of the file changes the problem, and what a link still can't do.
You made a quiz for your class, a quote for a client, a small calculator, or a report an AI tool built for you, and it's one .html file. Just before you send it, you realise the person on the other end could open it in Notepad, change a number, and pass it on with your name still on it.
It comes up regularly. A recent r/HTML thread asks whether there is any way to make a tamper-proof HTML file, one that can't simply be opened in Notepad and changed. The poster suspects they already know the answer. The honest short answer is that you can't lock the file. What you can do is change what you send.
Yes, and it takes no skill. An HTML file is text: tags, words, maybe some CSS and JavaScript, saved with a .html extension. A browser displays it. Any text editor opens it: Notepad, TextEdit, VS Code. Find the number, change it, save.
Nothing inside the file can prevent that. Any protection you add is written into the same file, and the person holding the file can delete it along with everything else.
So "how do I lock it" doesn't have an answer. "What am I actually worried about?" does. Usually it's this: an edited version travels onward, to a colleague, a parent or another supplier, and it looks like it came from you.
Each of these does something. None of them stops someone who has the file from editing it.
| Method | What it does | What it stops | What it doesn't stop |
|---|---|---|---|
| Minifying | Strips spaces and line breaks, shortens names in the code | Comfortable reading | Editing. The text on the page is still there in plain words, and a code formatter puts the line breaks back |
| Obfuscating or "encrypting" the HTML | Encodes the page so the file looks like gibberish, with a script that decodes it when it opens | Someone skimming the file in Notepad | The browser has to decode it to show it, and the developer tools show the decoded page. It also makes the file harder for you to edit next time |
| Blocking right-click | A script that cancels the right-click menu | Right-click → View page source, for people who don't know another way | The keyboard shortcut for view source, Save Page As in the browser menu, turning JavaScript off, or opening the file in a text editor, which needs no browser at all |
| Converting to PDF | Turns the page into a PDF | Editing in a text editor | Editing in a PDF editor. And anything interactive in the HTML is gone |
| A digitally signed PDF | Adds a signature tied to the exact contents | Undetected changes: a reader that checks signatures can show the file was altered after signing | Editing itself. It makes an edit visible to anyone who checks, and it's still a PDF, so nothing interactive survives |
Minifying and obfuscating are fine for keeping casual eyes off your code. They keep honest people honest. If you're worried about the edited copy someone forwards, they don't touch that.
When you send a file, what travels is a file, and every copy of it can be edited.
When you send a link, what usually travels is the link. Someone forwards it, and the next person opens the copy on the host, which is your copy. On a private-link host such as miinideck, the file behind a link can be replaced from the account that uploaded it and nowhere else. On paid plans you can also add a collaborator to a page, and they can push a new version of that page too. People who open the link can read it. They can't write to it.
That changes three things:
A link on its own is unguessable and kept out of search, which covers most of what people mean by private. What it doesn't cover, mainly forwarding, is in what a secret URL gets right, and where it stops. If you also want to control who can open it, add a password. On miinideck the page isn't sent to anyone until they enter the right password, and that's a different thing from a password prompt drawn on top of a page that has already loaded. How password protection on an HTML link actually works explains the difference. Passwords are free, including on uploads made without an account (the no-signup /try page), though those have no expiry control and the password can't be changed later.
If what you actually want from the other person is changes rather than a read-only copy, turn on Review for the page. They click on the page and leave a comment pinned to that spot, without an account, and the page itself stays as you uploaded it. Review is free on every plan.
Drop an HTML file to see what it looks like as a link. You can add a password without an account. To replace the file behind the link later, or change the password, sign in first. Both come with a free account.
Quite a lot, and it's better to know before you rely on it.
If you need to prove exactly which version someone received, use a format built for that. A digitally signed PDF is the usual one: sign it before you send it, and anyone who checks the signature can see whether it has changed since. Keep your own copy of whatever you sent, with the date.
That's a different problem from this one. Anything that runs in the user's browser is theirs to change, so the protection has to live on your server, which checks everything the page sends back. This article doesn't cover it.
.html file, or a ZIP if it has separate CSS, scripts or images. Use an account: uploads without one can't be replaced later, and their password can't be changed.A scheduled self-destruct retires a shared link on a date you set at upload — no reminder, no manual deletion. Here's why scheduling beats deleting by hand, how to pick the date, and what the viewer sees when the link retires.
Ask an AI assistant how to share a page privately and it will usually warn you that an unguessable URL is not real privacy. Half of that warning is correct. This is the half that isn't, the threats a random link genuinely does not cover, and the point where you should stop and put a login in front of it instead.
Every lever a private link gives you — expiry, password, searchable opt-in, custom domain, white-label, analytics — what each one is for, and which are free versus paid.
miinideck turns a single HTML file into an unguessable link with optional password and expiry. Default-private, never indexed.