# Password protection
In addition to access levels, a password can protect a download. The visitor enters it once and then downloads without needing a user account.
## Password for one download
 The tab “Access” only shows whether a password is set – never the password itself.
- Enter a password in the tab **Access** and save.
- Leaving it empty keeps the current password.
- **Remove the password** lifts the protection.
## Password for a category
 A category password protects every download of the category and its subcategories.A category password applies to every download of the category and its subcategories that has no password of its own. Whoever entered it once can fetch all these downloads.
## What the visitor sees
 The form appears when a visitor opens a protected download.
- Lists show a lock with the link **Enter password** instead of the button.
- After the right password the download starts at once.
- For the time in **Options → Downloads → Password valid for (minutes)** Fileshelf does not ask again (default 120 minutes; 0 until the browser session ends).
- After five wrong attempts the visitor has to wait briefly; the wait grows with every further wrong attempt, up to one minute. If a captcha is set up in Joomla, it is added from the tenth wrong attempt on.
- Fileshelf counts wrong attempts on the server, per password and visitor. A new browser window or deleted cookies do not reset the count. The visitor's address is stored for this only encrypted and deleted after a day.
- If 100 wrong attempts come together for one password within an hour, from whoever, Fileshelf locks it for everyone for 15 minutes. This slows down attacks from many addresses; afterwards it works as usual.
Fileshelf stores passwords only encrypted (as a hash). They appear neither in the form nor in the version history nor in an address. Simply set a forgotten password anew.