Secure links, not passwords: a friendlier way to share photos and bookings with clients

You finished the shoot. The gallery is ready. Now you just need the client to open it, pick their favourites, and say yes. The last thing you want is for that simple step to stall because someone cannot find a password. This is where the way you share matters more than most people think.

Why passwords get in the way

Passwords are a daily headache for the people you serve. Bitwarden's research found that a large share of people reuse the same password across many accounts, and many simply forget the ones they have. Worse for you as a business, Bitwarden reported that 55% of people have abandoned an account or made a brand new one just to dodge a password reset. Think about what that means for a client trying to view their photos. If the door has a lock they cannot open, some of them will walk away.

There is hard money in that friction. A widely cited case study from the scheduling tool Calendly, summarised in Baytech Consulting's review of magic links, found that 67% of people who quit sign-up did so at the password step. After moving to passwordless sign-in, completed registrations rose from 43% to 71%. Those are not Bookatu numbers and your results will vary, but the pattern is clear. Every extra hurdle at the door loses you people.

What a magic link actually is

A magic link is a private, one-time web address sent to your client's email or phone. They tap it and they are in. No password to invent, no reset emails, no sticky note on the fridge. As Descope explains in its plain guide to magic links, the link itself is the proof of who they are, because it was sent to an inbox only they control.

For your client the experience is one tap. Behind that tap, the system is doing the careful work so they do not have to.

How a secure link keeps things safe

A good secure link is not just a long web address. It follows a few rules that security teams have agreed on for years. The OWASP Forgot Password guidance, a respected open standard, sets out the same ideas that protect a magic link:

• It is random. The link holds a long, randomly generated code that no one can guess. Picture a key cut so precisely that no copy fits the lock.
• It expires. The link only works for a set window. OWASP advises that these links should rarely last more than a short period for sign-in, which is why an old email cannot be used to break in months later.
• It can be used up. Once the job is done, the link can be retired so it is not a permanent back door.
• It is tied to one person. The link is meant for the inbox it was sent to, not for forwarding around a group chat.

Time-limited, single-use links are not a gimmick. They are the same quiet safeguards that sit behind the password reset emails you already trust every day.

Why public links are riskier than they look

Plenty of people share client work with a plain public link from a cloud drive. It feels friendly and fast. The trouble is that a public link has no idea who is on the other end. Anyone who receives it, on purpose or by accident, can open it. Forwarded to a family thread, pasted into a chat, or left in an old email, that link often keeps working long after the project is done. For private portraits, newborn sessions, or anything a client expects to stay theirs, that is a real worry.

A secure link with an expiry date closes that gap without making life harder. The client still gets a simple tap to open their gallery. The difference is that the door does not stay propped open forever.

How this works in Bookatu

Bookatu is built around this idea so you do not have to think about it. Your clients reach their portal through passwordless magic links. There is no account password for them to set up or lose, which keeps the path from their inbox to their booking short and clear.

For photographers, the same thinking runs through private client galleries. You upload your full-resolution files. Bookatu automatically makes a low-resolution preview at 1080px with your watermark baked in and the photo's hidden location data stripped out, so what your client browses is a safe proof, not your finished art. They pick favourites, get an included free count, and pay for any extras. The full-resolution files unlock only once that set is settled. You share the gallery with a secure link that lasts 30 days, and a delivery board keeps every studio handover in one place.

All of it carries your branding and theme, with a dark mode if that suits your look. The link feels like part of your studio, not a generic login screen.

A friendlier handover, and fewer dropped balls

When access is one tap, people actually take the next step. They open the gallery, confirm the booking, and reply. Fewer clients get stuck at a login wall and go quiet, which means fewer missed handovers and fewer half-finished sales sitting in your inbox. You spend less time playing tech support over a forgotten password and more time on the work you were hired for.

Secure links are the rare upgrade that is both safer and kinder. Your client gets a smoother, more private experience. You get peace of mind that an old link will not float around the internet forever. That is a better way to hand over photos, and a better way to confirm any booking.

Sources

• OWASP Forgot Password Cheat Sheet (time-limited, single-use tokens): https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html
• Bitwarden: A closer look at password statistics: https://bitwarden.com/blog/a-closer-look-at-password-statistics/
• Baytech Consulting: The Truth About Magic Links (UX, security, growth): https://www.baytechconsulting.com/blog/magic-links-ux-security-and-growth-impacts-for-saas-platforms-2025
• Descope: What are magic links and how do they work: https://www.descope.com/learn/post/magic-links