HomePrivate digital invitations guide

Any occasion

How do you keep a digital invitation private?

An invitation tells a stranger exactly where the people you love will be, and when. Sending it digitally makes it faster and cheaper — and, handled carelessly, more shareable than you meant. Here is what actually leaks, which gates are worth the effort, and the wording that keeps guests happy about it.

Privacy is mostly about how you send, not what you buy. A file sent person-to-person through channels you control — a text, an email, the family group chat — is private by default. A public link is not. For most celebrations, direct sending plus a password on anything you host online is enough. For a higher-risk celebration, unique per-guest links are the stronger gate.

Why invites leak more than you think in 2026

A paper invitation could be photographed and shared, but it took effort. A digital one is a file or a link, and links travel: forwarded to a plus-one, pasted into a group chat with strangers in it, posted in a screenshot with the venue legible. Three things turned a small privacy risk into a real one this year:

  • Invite scams got convincing.“You’re invited” phishing messages now copy the look of real invitation platforms, and guests are trained to tap links from senders they don’t recognize.
  • Open pages get scraped.A wedding website with no password sits on the public internet, and automated scraping doesn’t care that it was meant for forty people — names, dates and venues end up in search results.
  • Oversharing does the attacker’s work.A countdown post plus a venue tag plus a date tells anyone where you’ll be — and when your home is empty.

None of this means going back to paper. It means treating the invitation like what it is: a document with your family’s schedule on it. (The buying side — who made the design, what happens to your wording — is covered in our human vs AI invitations guide; this one is about sending.)

The threats: invite scams, scraping and stalking

Different gates stop different threats, so name yours first:

  • Phishing invite scams— a fake RSVP page harvesting your guests’ names, addresses and card details. The best defense is guests knowing exactly what your real invitation looks like and where it comes from.
  • Scraping of open links — details you thought were between forty people become findable by anyone who searches your names.
  • Targeted stalking — the most serious of the three: a person you specifically did not invite knowing exactly where to find you, your guests or your kids.

Gating options compared: passwords, unique links, QR codes and RSVP checks

Privacy comes in layers. Each option below is described by what it stops and by its main failure mode, because every gate has one:

  • A shared password stops casual strangers and scrapers. Failure mode: guests forward the password along with the link.
  • Unique per-guest links make link-sharing visible — a leaked link points back to exactly one name. Failure mode: more setup, and you track who got which link.
  • Single-use QR codes are per-guest links for the door of a large party. Failure mode: overkill for most celebrations.
  • RSVP checks — a form that confirms guests against your list before showing details — stop strangers from RSVPing at all. Failure mode: friction for the guests you most want to hear from.
  • ID or selfie checkssit at the far end of the scale, and we’d talk you out of them for nearly every celebration: collecting photo IDs means holding exactly the kind of personal data this guide is about protecting. A person at the door with a list does the same job with none of the data.

Password protection: pros, cons and setup tips

Password-protected invitations and wedding pages are the right default for most hosts — nearly every wedding website builder has the feature, and it takes minutes:

  • Pick a phrase, not a birthday.Two unrelated words and a number (“maple-42-lantern”) beat anything guessable from your public life.
  • Send the password separately from the link— link by email, password by text — so one forwarded message doesn’t hand over both.
  • Rotate it if it leaks. Send the new password to the guest list and the old copies floating around go dead. That revocability is the real advantage over an open page.
  • Skip password-protecting the PDF itself. The password travels in the same chat as the file, and a guest locked out is worse than a stranger let in. Gate the details page; let the card be the beautiful part.

Unique per-guest links and QR tokens: scale and trade-offs

For a destination wedding, a guest in the public eye, or any celebration where you’d genuinely mind an uninvited reader, per-guest links are the upgrade — and you don’t need custom engineering. Mainstream RSVP tools will generate a secure link per household from a spreadsheet of names. The trade-offs: forty individual messages instead of one broadcast, and the spreadsheet becomes your source of truth. At real scale, add single-use QR codes only where a name-checking human isn’t practical.

Balancing guest friction and safety

Every gate costs your guests something, so fit the gate to the actual risk:

  • A kid’s birthday or a backyard shower: direct sending is the whole plan. No passwords, no tools.
  • A typical wedding: direct-sent invitations plus a password on the wedding website. One step, and grandma can manage it.
  • Higher risk — destination weddings, public-eye guests, a known unwanted person: per-guest links, RSVP checks, a photo policy stated up front.

Whatever you choose, plan the fallback: one named person (not the couple) whom a stuck guest can text, with their number on the invitation. For guests who struggle with links entirely, a phone call is the gate.

Privacy-first wording: templates you can copy

The gate works better when the wording around it is warm:

  • Gated-invite note:“Our details page is password-protected so it stays between us — the password is in the text that came with this. Trouble getting in? Message Anna at (555) 012-3344.”
  • Photo-consent notice:“We can’t wait to see the pictures — please share them in our private album rather than publicly, and hold photos of the kids back from social media.”
  • RSVP privacy line:“Your RSVP goes only to us. We’ll use your details for this celebration and nothing else.”
  • If you must explain stricter checks:“Because some of our guests need their privacy protected, we’re confirming everyone against our list before sharing the venue. Thank you for two minutes of patience.”

A private-invite workflow, start to finish

The whole plan for a busy host — private by default, gates layered on top:

  1. Personalize a design in your browser — say Ribbon & Rice from the wedding designs, or Pencil It In as a private save the date.
  2. Put on the card only what a guest needs and a stranger can’t use. First names, date, venue name. Leave off your home address, kids’ schools, and anything about when your house will be empty.
  3. Buy it once, and both files arrive in your inbox— a print-ready PDF and a PNG for sending. There’s no account and no guest list here, and who sees your invitation is decided entirely by who you send it to. We can’t leak an RSVP list we never collect.
  4. Send the PNG person-to-person — individual texts or emails, never a public post. The moment an invitation touches a public feed, every gate downstream matters less.
  5. Layer one or two gates from the comparison above: a password for most, per-guest links for higher-risk celebrations.
  6. Overshared on the card itself? Every Olive order includes one free revision — tell us what to change and corrected files are emailed to you.

Before you send — and what to do if something leaks

The checklist:

  • Card carries first names, date, venue name — nothing a stranger can use
  • Password chosen (a phrase, not a guessable date) and sent separately from the link
  • Fallback person named, their number on the invitation
  • Photo and RSVP wording included if you want it
  • Guests told what your real invitation looks like, so a fake one reads wrong
  • A calendar note two weeks out to search your names and venue, and see what’s public

And the escalation plan, so a bad moment has a next step:

  • A fake invitation is circulating: tell every guest at once, with a picture of the real one, and report the scam message to the platform it came from.
  • Your link or password leaked publicly: rotate the password or reissue links, then ask the site where it was posted for removal.
  • Someone uninvited has the details, and that frightens you:change what you can, brief the venue early — they handle this more often than you’d think — and involve the police where there’s a known person with a history.

Questions people ask

Do password-protected invitations actually stop invite scams and link-sharing?

They stop scraping and casual strangers, which is most of the risk. They don’t stop a guest forwarding both link and password — for that, per-guest links are the tool.

Are unique per-guest links or QR codes better than a single password?

Stronger, yes — a leaked link identifies its owner and can be cut off alone. For most celebrations the password is enough; the links earn their setup cost when there’s a specific reason to gate hard.

Can I ask guests to upload ID or a selfie to RSVP?

You can, but we’d steer you away: a folder of your friends’ photo IDs is a bigger privacy liability than the one you started with. A person at the door with a list achieves the same and deletes itself.

How do I tell guests why the invite is gated without sounding paranoid?

Lead with warmth: “so it stays between us” reads as intimacy, not fear. Nobody has ever RSVPed “no” because a website asked for a password.

What should I do if my invite link has been shared publicly?

Rotate first: change the password or reissue the link so the shared copy dies, then request removal from wherever it was posted. If there’s someone specific you’re worried about, brief the venue.

Will gating annoy my guests?

One password, sent with a friendly line and a fallback number, annoys nobody. Friction starts to cost you at two or more steps.

Which formats are safer — PDF, PNG or a hosted page?

Files you send directly are as private as the channel you send them through, and can’t be scraped from the open web. A hosted page is the powerful-but-exposed option: gate it. Our digital invitations guide covers sending well in more detail.

When you are ready

Sent to your people, and no one else

Pick the piece you need, personalize it in your browser, and both files arrive the moment you pay — a print-ready PDF and a PNG for sending, with one free revision if anything is wrong. No account, no guest list, nothing held that could leak.

Browse the designs