quarto-lock: password-protect a Quarto site on static hosting
I built quarto-lock, a Quarto extension that puts a shared password in front of a rendered HTML website or book on static hosting such as GitHub Pages. It suits course material, drafts and project reports that should not be open to everyone, where running a server would be more than the job needs.
The protection is encryption at build time. After quarto render, the extension encrypts every local file of the site — pages, CSS, JavaScript, images, fonts, the search index and downloads such as PDFs — with AES-256-GCM, under a key derived from the password with PBKDF2 and a fresh salt for each build. What gets published is a small lock screen and ciphertext; the password is never written to the published files. The browser decrypts the content after the visitor types the password and keeps only the derived key for the session.
The lock-screen text can be translated or replaced through environment variables, and the documentation includes GitHub Actions workflows for two setups, one of them a private source repository that publishes only the encrypted output to a public Pages repository.
It is deliberately a lock, not an authentication system: there are no individual accounts, revocation or password recovery, everyone with the password has the same access, and changing the password means rebuilding the site. Resources loaded from CDNs or remote APIs stay outside the encryption. The documentation is public and links to a separate protected demo: https://lsbjordao.github.io/quarto-lock/