Frequently asked questions

No. You create a link and get two URLs: a public one to share and a private management key. We store only a one-way hash of the key, so save it — nobody can recover it, including us. There is a one-click download on the success screen for exactly this reason.

The link keeps working forever, and you can no longer edit or delete it. There is no recovery, because there is no account to prove ownership of and only a hash of the key in our database. That is the same property that means a database breach hands an attacker no usable credentials.

Yes — destination, title, description, avatar, theme, expiry and unlock cap. The slug cannot change, because by the time you want to change it the URL is already in video descriptions and pinned comments. The step list is also fixed after creation: changing the requirements under people who already hold the link would change the deal after the fact.

One or two. Every additional step costs completions, and the analytics show you exactly where people drop off. If you want one step to carry real weight, make it a code step — a code spoken in a video cannot be completed by someone who did not watch it.

Yes. Set a maximum and the link stops working after that many unlocks. It is enforced atomically in a single database statement, so a cap of 100 means exactly 100 even when a hundred people click at the same moment.

The endpoints exist and are documented in the README, but there is no API key and creation is rate limited to 40 links per day per address. Automated bulk creation is against the acceptable use policy. If you have a legitimate integration in mind, get in touch first.

Keyway validates every destination against private addresses, spoofed domains and a denylist, and it shows you the destination hostname before you continue. It cannot tell you a brand new phishing site is a phishing site — nothing can. Nothing ever auto-redirects you, and there is a report button on every page.

Link steps have a three-second minimum between opening the link and confirming it, enforced on the server. It exists so a script cannot complete eight steps in eight milliseconds. Message, confirmation and code steps have no wait at all.

No. Social steps in Keyway are visits — the page opens, you come back, you confirm. A creator can invite you to subscribe underneath the button, and it is genuinely optional. No link locker can verify a subscription; anything claiming to is guessing.

Your country, a device category (mobile, tablet, desktop or bot) and a referrer category (search, social, chat, and so on). Not your IP address, not your user agent, not the URL you came from, and nothing that identifies you tomorrow. No ad networks or analytics tags load on any page.

It may have expired, been turned off by its creator, hit its unlock limit, or been disabled for safety — the page will say which. If it says "not found", check for a typo: slugs are lowercase and never contain 0, 1, l, i or o, so a mistyped one is usually one of those.

Yes, with no ads and no upsell in the unlock flow. Every marketing page is static HTML at the edge and an unlock page is one indexed database read plus one analytics event — the whole thing costs almost nothing to operate at creator scale. There is no plan where your visitors see advertising.

An independent product, not affiliated with SubtoUnlock, Sub2Unlock, or any platform named on this site. It runs entirely on Cloudflare — Workers, D1, KV, R2 and Analytics Engine.

40 links per day per address, 8 steps per link, 512 KB per avatar, 2,048 characters per URL, and a maximum expiry of one year. These exist to prevent abuse, not to sell a plan — a creator will never reach any of them.

Unlock pages do, completely — every step is a real form and progress lives in a signed cookie. The link builder does not, because adding and reordering a dynamic list of steps is not something HTML can express without a page load per edit. That trade is deliberate: visitors are the ones on unreliable connections.

English and Vietnamese, both written rather than machine-translated, including the error messages and help text. Your unlock page can be in either regardless of which language you build it in. More will follow when there is a human to write them properly.