What the secret address of a Google calendar really gives away
Buried in the settings of every Google calendar is a link that shows everything on it. No sign-in, no permission, no record of who opened it.
What most people assume
That a private address is private because it is hard to find.
A link is a password that cannot be changed for one person
The secret address carries full details — titles, times, locations, notes. Anyone holding the link sees them, and there is no list of who does.
Its only protection is the random part of the address. That is genuine protection against guessing, and none at all against forwarding, a shared screen, or a document that outlives the job.
Resetting it breaks it for everybody
You can reset the address, which makes the old one dead. It also makes it dead for every colleague, every dashboard and every script quietly relying on it, with no warning to any of them.
That is the argument for never handing out the address of a calendar you live in. Publish a calendar made for the purpose, and the reset costs you nothing.
The numbers
| What it describes | Value |
|---|---|
| Random characters protecting a share link of our own | 22 |
| What sharing an event from the app costs | 0 |
What it looks like
What to do
- Treat the secret address as public the moment it leaves your hands.
- Never publish the address of the calendar you actually use.
- Reset it when somebody leaves, and tell the people it will break.
Questions
- What can someone do with the secret address of my Google calendar?
- See everything on it — titles, times, locations and notes — without signing in or being granted permission, and without leaving any record that they looked.
- Can I take a secret calendar address back?
- Only by resetting it, which kills the old address for everyone at once: colleagues, dashboards and any script quietly relying on it, none of whom are warned.
- Is it safe to email the secret address to a colleague?
- Treat it as public from the moment it leaves your hands. Its only protection is being hard to guess, and forwarding defeats that completely.