Ask HN: Best practice for public links that are private

I'm trying to build a web app where users can share sensitive information with their trusted friends via a public link. I'm thinking of making it password protected, so you need the link plus a code. I want this feature so an attacker cannot just brute force all link combinations to get the user profiles. I was wondering if there is a better way to do this than passwords