docusaurus-plugin-password-gate

A client-side password gate for Docusaurus v3 sites. Visitors must enter a password before seeing any content.

Install

npm install docusaurus-plugin-password-gate

Setup

1. Generate a password hash

echo -n "your-password" | shasum -a 256 | cut -d " " -f 1

Or use the bundled helper:

./node_modules/docusaurus-plugin-password-gate/scripts/hash-password.sh "your-password"

2. Add to docusaurus.config.ts

export default {
  plugins: [
    [
      'docusaurus-plugin-password-gate',
      {
        passwordHash: '5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8',
      },
    ],
  ],
};

Options

| Option | Type | Default | Description | | ---------------- | --------- | -------------------------------- | ------------------------------------------------ | | passwordHash | string | required | SHA-256 hex hash of the password | | siteName | string | 'Documentation' | Heading shown on the gate screen | | placeholder | string | 'Enter password' | Input placeholder text | | buttonText | string | 'Enter' | Submit button label | | errorMessage | string | 'Incorrect password.' | Message shown after a failed attempt | | persistSession | boolean | false | true = localStorage (survives restart), false = sessionStorage (clears on tab close) | | storageKey | string | 'docusaurus-password-gate' | Storage key used for the auth token |

Security Model

This plugin is not a security boundary. The password hash is shipped in the client-side JavaScript bundle and can be extracted by anyone who inspects it.

It is suitable for:

• Keeping casual visitors out of internal documentation
• Preventing search engine indexing of gated content
• Staging site access control where real auth is overkill

It is not suitable for:

• Protecting sensitive or regulated data
• Multi-user access control
• Compliance-regulated content

For truly sensitive content, pair this with hosting-level authentication (Cloudflare Access, nginx basic auth, Vercel password protection, etc.).

License

MIT