Can the hosting provider read my password-protected page?

No - the page is encrypted in your browser before upload. The host stores and serves only the encrypted version; visitors decrypt it in their browser with the password.

Is password protection safe for sensitive data?

It's solid protection for 'not for everyone' pages - invites, drafts, client previews. Don't use it for sensitive content: protection is only as strong as the password, and images/CSS/JS assets aren't encrypted, only the HTML.

I forgot the password I set - can I recover it?

pushd saves the password locally per site, so check the Password panel for that site name. If you've cleared extension data, there's no recovery - redeploy the page with a new password.

Docs

Password protection

A Pro option on the deploy screen that locks your page before it leaves.

How it works

Your page is encrypted in your browser before upload. What lands is a self-contained gated page plus your encrypted page data - no one hitting the URL without the password can read your page. Entering the password decrypts the page right in the visitor’s browser. No accounts or servers involved.

Caveats

Not all resources are encrypted. Images, CSS and JS files uploaded alongside your HTML are not - someone with the direct file URL could fetch an image.
Protection is only as strong as the password. Anyone can download your encrypted page and begin guessing offline - “password1” won’t survive that. Use a real one.
Not for sensitive content. Invites, drafts, client previews, prototypes, landing pages: great. Passports, financials, anything regulated: no - that probably shouldn’t be on static hosting at all.

Passwords are remembered

The password is saved locally per site name, so you can view it later in the panel, and redeploys keep the site protected without re-typing. It never leaves your browser. (Clear extension data and it’s gone - there’s no recovery, redeploy with a new one.)

Add pushd to Chrome - it's free All docs