Sharing and access
Who can open a drop: the three access levels, passwords, email invitations and what open drops add for sharing.
Last updated
Three access levels
The maker sets the access level in the Sharing window of the drop page (the Sharing tile, or the round button that says Private, Password or Open). Opening a drop up further (from private to password, or to open for anyone with the link) asks the maker to confirm first; making it more closed never does.
- Private: only the maker, signed in to Toolcrow, can open the drop.
- Password: anyone with the link and the password can open it.
- Open: anyone with the link can open it.
New drops start as private, or with a password when the maker sets one while creating the drop. A drop created by a connected AI always starts as private. Visitors never need a Toolcrow account. Toolcrow has no visitor logins or per-person access lists: the link, the password and the private setting are the locks. How each level is enforced is in How your tools are protected.
Passwords
- A password is 8 to 200 characters. Toolcrow stores it securely. The drop page does not load it until the maker clicks Show in the Sharing window.
- After entering the right password, a visitor stays unlocked in that browser for 12 hours.
- Repeated wrong guesses are slowed down.
- The maker never needs the password for their own drop.
- Changing the password, or making a drop private, locks out everyone who had unlocked it before.
Email invitations
- From the Sharing window ("Send the link") the maker can send the drop to people by email. The email contains the link, for a password-protected drop the password, and an optional short note from the maker.
- An invitation does not give extra access: it is a convenient way to send the link, and the list shows who it was sent to.
- Invitations cannot be sent for private or turned-off drops.
- Two numbers depend on the maker's plan: how many email addresses can be on one drop's invitation list, and how many invitation emails the maker can send in 24 hours (counted over all of their drops). Removing an address from the list frees a place on it; the link keeps working for that person.
- These numbers only limit the invitation list. They do not limit how many people can open the drop: that is anyone with the link (and the password, if there is one).
Open drops
- Open drops show a share panel in the "Powered by Toolcrow" badge, and link previews (title and image) when the link is posted in chats or social media.
- The share panel has a "Report abuse" link. Anyone can report a drop at
toolcrow.app/report.
Visit counts
- The maker sees how many visits the drop got, in the Usage panel on the drop page. Toolcrow also notes which site a visit came from (only the site name); the drop page does not show that at the moment. This works the same for open, password-protected and private drops.
- Only people are counted. A visit counts once the visitor actually does something in the tool (moves the mouse over it, clicks, types, scrolls or touches the screen) after a few seconds on the page. Search engines, link previews in chats, AI assistants that read the page, uptime checkers and scripts are never counted, and neither is the maker while signed in to Toolcrow.
- A visitor who opens the tool and leaves without moving the mouse over it or touching it is therefore not counted either. Pressing only keyboard shortcuts (such as closing the tab) does not count. The numbers are a little lower than every page load, but every visit in them is a person.
- Toolcrow counts visits, not people: someone who opens the tool three times counts three times. Days run on Amsterdam time.
- Until 21 October 2026 every page load counted, so totals from before that date may include some automated visits.
- On the drop page, the "?" next to each number in Usage explains how that number is counted.
- No other analytics run on a drop: Toolcrow's own measurement tools stay off the pages where tools are served.
Data and access
The access level also protects the data functions: a visitor who cannot open the drop cannot save or read its shared data. Shared values (see Saving data) are visible to everyone who can open the drop.
