Ask HN: Best practice for public links that are private

I'm trying to build a web app where users can share sensitive information with their trusted friends via a public link.

I'm thinking of making it password protected, so you need the link plus a code.

I want this feature so an attacker cannot just brute force all link combinations to get the user profiles.

I was wondering if there is a better way to do this than passwords