Two minutes, start to finish
How a Keyway link works
Two halves: what you do once, and what every visitor experiences afterwards. This page covers both, including the parts most tools in this category are vague about.
For you, once
- 1
Paste the link you want to protect
A Google Drive folder, a Dropbox file, a Notion page, a release on your own site — anything reachable over http or https. Keyway validates it before accepting: private network addresses, javascript: URLs, links carrying a username and password, and lookalike domains that mix alphabets are all refused.
- 2
Add the steps a visitor must complete
Between one and eight. Send them to your channel or community, show them a message, ask them to confirm something, or ask for a code you shared elsewhere. Drag to reorder; mark any step optional if you would rather invite than require.
- 3
Choose how it looks and how long it lives
Pick a theme, add your name and an avatar, set the unlock page language, and optionally set an expiry date or a maximum number of unlocks. Both limits are enforced on the server, so a cap of 100 means exactly 100.
- 4
Create the link and save your key
You get two URLs. The short one is public — share it anywhere. The other is your management key, and it is shown once. Keyway stores only a one-way hash of it, so if you lose it nobody can recover it, including us. There is a one-click download for exactly this reason.
For every visitor, every time
- 1
They open your link
The page renders on the server with your title, your avatar and your steps. There is no interstitial, no countdown before the page appears, and no advertising.
- 2
They work through the steps
Link steps open in a new tab. When they come back, a confirm button becomes available after a short, real wait — usually three seconds. Code steps check the code against a salted hash on our server and reject a wrong one.
- 3
They unlock
When every required step is complete, the unlock button activates. The server re-checks everything — expiry, moderation status, the unlock cap — and only then issues a short-lived token.
- 4
They continue to your content
They see the destination hostname and click through themselves. Nothing redirects automatically, and the full URL never reaches their browser until that click — it exists only in a redirect header, for one hop.
The step types, and what each one actually proves
This is the part worth reading carefully, because it is where link lockers usually overstate themselves. Keyway sorts every step into one of two categories and labels it on the page the visitor sees.
Steps we genuinely verify
Enter a code. You choose a code and share it somewhere only your real audience will see it — spoken in a video, in a pinned comment, in a community post. Keyway stores a PBKDF2 hash with a per-step random salt and never stores the code itself. A wrong code is rejected server-side, and the endpoint is rate limited so it cannot be guessed at speed.
Confirm a statement. The visitor explicitly agrees to a sentence you wrote. We record that they did. That is a small thing, but it is a true thing, which is more than can be said for most of this category.
Steps that record what the visitor tells us
Every social and website step is a visit step. Keyway confirms the link was opened and that a real interval passed before the visitor confirmed. It does not confirm what they did on the other side, and the page says so in those words.
That is not a limitation we chose. YouTube removed the API scope that would allow a third party to check a subscription — specifically because it was being used for this. Instagram, TikTok and X have never offered one. Discord can confirm guild membership only through a full OAuth flow that the visitor would have to authorise, and using it to gate content still breaks Discord's terms. And every platform named here prohibits incentivised engagement in its developer policy.
So a tool that tells you it verified a subscription is either using an undocumented method that will break, or it is guessing and telling you it knows. We would rather be the tool that says "the visitor confirmed this themselves" and is right.
What you can still ask for
Plenty. You can put a note under any button inviting a subscribe or a follow — most people who wanted your file will do it. What you cannot do is require it, and Keyway will not claim it happened.
Managing the link afterwards
Your management link looks likesubtounlock.app/manage/abc12xyz#k=…. The part after the# is a URL fragment, and browsers never send fragments to a server — it does not appear in our access logs, in a Refererheader, or in any proxy between you and us. The page reads it, exchanges it for a session cookie, and clears it from your address bar and history.
From there you can:
- Change the destination, title, description, avatar and theme
- Add, remove, retype and reorder steps
- Change or remove the expiry date and the unlock cap
- Turn the link off temporarily, and back on
- Delete it permanently — the destination is erased from our database
- See your analytics
One thing you cannot do is recover a lost key. We hold a SHA-256 hash of it and nothing else. That is a deliberate trade: it means a database breach hands an attacker no usable credentials, and it means we cannot be social-engineered into giving your link to someone else. Download the key file when you create the link.
Questions about the flow
Does the unlock page work without JavaScript?
Yes, completely. Every step is a real HTML form and progress is stored in a signed cookie, so the whole flow works with scripts disabled or blocked. JavaScript, when it loads, removes the page reloads and adds the countdown — it is not required for anything. The link builder is the exception: adding and reordering steps needs it.
How long does a visitor have to wait on each step?
Three seconds on link steps, and nothing at all on message, confirmation and code steps. The three seconds is a real, server-enforced minimum between opening a link and confirming it — not a decorative countdown. It exists so a script cannot complete eight steps in eight milliseconds. A person switching tabs and switching back has usually already spent longer than that.
Can I change the link after sharing it?
Yes. Open your management link and you can edit the destination, the title, the steps, the theme, the expiry and the unlock cap. The slug — the part after /u/ — is the one thing that cannot change, because it is already in video descriptions and pinned comments by then.
What happens when a link expires?
Visitors get a page explaining that the creator set an expiry and it has passed, with a suggestion to ask you for a new link. They are not redirected anywhere and the destination is never revealed. Expiry is checked on every single request, so it takes effect the moment it lapses.
Can I see who unlocked my link?
No, and that is by design. You get counts: views, approximate unique visitors, unlock rate, top countries, device categories, and where people dropped off. You do not get identities, IP addresses or anything that follows a person across days, because none of that is collected in the first place.
Make your first link
No account, no email, nothing to cancel. If it is not useful, close the tab.