One password per gallery: how to keep two clients from ever sharing access

The mix-up rarely looks dramatic. You reuse last month's delivery message as a template, change the client's name, and miss the password line. Or one password has been doing the rounds for a while, and a client who received it for their own session can now open someone else's. Nobody meant any harm, yet one family can see another family's photos.

The simplest safeguard is also the least exciting: every gallery gets its own password, chosen with a little care, sent with a little care, and changed when there is a reason.

Why one password per gallery

When each gallery has its own password, a problem stays contained. A forwarded email, a bookmark saved on a shared computer or a message sent to the wrong person affects one session, not your whole client list. You can change that one password without touching anyone else's access, and a past client can't open a new gallery with an old code out of habit.

PixiProof's security page puts it plainly: a separate password per gallery reduces the risk of mixing access between sessions.

A password a client can actually type on a phone

Long strings of symbols and mixed case look secure, but a client typing them on a phone is likely to get one character wrong and message you instead. The UK National Cyber Security Centre suggests a different approach: combine three random words. The NCSC says complex character rules are not helpful, and that writing a password down is fine as long as you keep it somewhere safe.

In an earlier NCSC blog post on the same method, the advice is to avoid easy-to-guess words and words closely related to you personally, such as the names of family members or pets. The NCSC writes about personal accounts, but the same logic carries over to a gallery: skip the couple's names, the wedding date and your studio name. Three neutral, unrelated words are easier to type and harder to guess.

Send the link and the password separately

If the gallery link and the password sit in the same email, one forwarded message hands over both. Sending the password in a separate message, or through a different channel, means a client can forward the link to a relative without also forwarding the way in. It is a small habit, and it pairs well with another one: before you reuse an old delivery message, check that both the link and the password belong to this client.

When to change a password

The US National Institute of Standards and Technology sets rules for services that check passwords. In NIST SP 800-63B-4, those services should not impose rules about mixing character types and should not require periodic password changes. They should force a change when there is evidence of compromise.

That principle translates well to client galleries. There's no need to rotate gallery passwords on a calendar. Change the password when you know it has reached someone it shouldn't have: a message sent to the wrong address, a forward you didn't expect, a shared screen.

If the gallery contains personal data

Under the GDPR, a personal data breach is "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data". The European Data Protection Board quotes that definition from Article 4(12) in its guidelines on breach notification. The same guidelines quote Article 33(1): the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people's rights and freedoms.

The UK Information Commissioner's Office guide to personal data breaches uses the same definition and adds that it covers accidental causes as well as deliberate ones. This is not legal advice, and whether a particular mix-up needs to be reported depends on the risk involved. The point is simpler: keeping each client's access separate is part of looking after their data, not only good manners.

How PixiProof handles gallery passwords

PixiProof galleries are password-protected by default. When you create a gallery, you type your own password or leave the field empty and PixiProof generates one. Only people who know it can see the photos. PixiProof says passwords are not stored in plain text. You can't reuse the same gallery password on two galleries in one account, which reduces mistakes and accidental access sharing between clients. You can change the password at any time or delete the whole gallery (pricing and FAQ).

Instead of a password, you can choose one of two other access methods:

• A 6-digit PIN. PixiProof rejects PINs that are too common or too predictable, such as repeated or sequential digits, and the same code can't be used on another gallery in your account. PixiProof's own description of the option calls a PIN convenient but weaker than a password.
• A private link. Anyone with the full address can open the gallery without signing in. Switching to link access removes the current password or PIN. If the link has been shared too widely, you can generate a new one, and previous links stop working.

The principle of this article still applies to links: one gallery, one client, separate access. The advice to send the password separately doesn't work here, because the link is the only key, so check the recipient with extra care.

For the other layers that protect previews, see how PixiProof protects your photos. Your first gallery up to 1 GB is free, no card required.

Before you send the next gallery

• Give the gallery its own password: three unrelated words, no names or dates.
• Check that the message template has this client's link and this client's password.
• Send the password separately from the link.
• If the password reaches the wrong person, change it.