GitHub Pages/Jekyll Password Protection
Automatically password protect (with encryption) certain pages on GitHub Pages/Jekyll sites using PageCrypt.
Demo
This repository serves as an example repository for password protecting pages. See example.html (password: examplepassword) and example-2.html (password: repo_by_evanbaldonado.com!).
Usage
- Configure passwords for .html pages in _protected_pages.txt.
- Add one file per line (space-delimited in the format
filename.html password).
- Note that GitHub converts markdown (.md) files to .html files.
- Because this file begins with an underscore, it will not be published when your site is deployed.
- Add a GitHub action/workflow for encrypting pages: /.github/workflows/pages-with-encryption.yml.
- Make sure that it targets the correct branch you want to use for deployment (see line 6:
branches: ["main"]).
- Automatically deploy this repository with GitHub Pages using GitHub Actions:
Settings > Code and automation > Pages > Build and deployment > Source > Github Actions. You can manually run this Action; it will also automatically run when you update your repository.
Security
- Static websites deployed with GitHub pages can’t run server-side code, which means that traditional authentication approaches to access protected files aren’t possible. Additionally, GitHub pages does not support .htaccess files, another easy way to password-protect pages.
- This method relies on PageCrypt to encrypt pages using the Web Crypto API. This allows the user to view/access/download pages but only see their contents with a password.
- Because the user can access these files, they can download them and perform a brute-force attack to attempt to unencrypt them. Your files are only as secure as the Web Crypto API, PageCrypt, and your passwords.
- PageCrypt only encrypts .html files. For other assets (ex: .css files, .js files, and images), consider inlining them if they must remain private. See PageCrypt’s documentation.
- Note: although the password file (_protected_pages.txt) is not published along with your site, anyone with access to the repository itself can view it.
- For more information, see PageCrypt’s documentation.
License & credits
This repository by Evan Baldonado is published under the AGPL-3.0 license. It utilizes PageCrypt by Samuel Plumppu (a complete rewrite of Maximillian Laumeister’s original code).
Contributing
Feel free to submit issues/pull requests!
You can start a discussion on this repository or contact password@evanbaldonado.com with questions. The PageCrypt repository also has additional information about the encryption process itself.