diff --git a/.gitignore b/.gitignore
index c001800..03966ac 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,4 @@ gradle-app.setting
 !gradle-wrapper.jar
 .gradletasknamecache
 out/
+password-dont-edit.txt
diff --git a/src/main/java/moe/lemonsh/waifu2xlemon/AccessTokenGenerator.java b/src/main/java/moe/lemonsh/waifu2xlemon/AccessTokenGenerator.java
new file mode 100644
index 0000000..5dea434
--- /dev/null
+++ b/src/main/java/moe/lemonsh/waifu2xlemon/AccessTokenGenerator.java
@@ -0,0 +1,14 @@
+package moe.lemonsh.waifu2xlemon;
+
+import java.util.Random;
+
+public class AccessTokenGenerator {
+    private static final char[] allowedCharacters = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890".toCharArray();
+    private static final Random rng = new Random();
+
+    public static String randomToken(int length) {
+        var token = new char[length];
+        for (int i = 0; i < token.length; i++) token[i] = allowedCharacters[rng.nextInt(allowedCharacters.length)];
+        return new String(token);
+    }
+}
\ No newline at end of file
diff --git a/src/main/java/moe/lemonsh/waifu2xlemon/App.java b/src/main/java/moe/lemonsh/waifu2xlemon/App.java
index 26621d0..67f122c 100644
--- a/src/main/java/moe/lemonsh/waifu2xlemon/App.java
+++ b/src/main/java/moe/lemonsh/waifu2xlemon/App.java
@@ -2,14 +2,10 @@ package moe.lemonsh.waifu2xlemon;
 
 import javax.servlet.MultipartConfigElement;
 import javax.servlet.http.Part;
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
+import java.io.*;
 import java.net.URLConnection;
 import java.nio.charset.StandardCharsets;
 import java.util.Objects;
-import java.util.stream.Collectors;
 
 import static spark.Spark.*;
 
@@ -22,6 +18,20 @@ public class App {
             System.out.println("Error: Invalid config. Make sure that the WAIFU2XLEMON_PORT and WAIFU2XLEMON_EXECUTABLE envvars are set.");
             System.exit(1);
         }
+        String envpass = System.getenv("WAIFU2XLEMON_PASSWORD");
+        if ("RANDOM".equals(envpass)) {
+            var passwordFile = new File("password-dont-edit.txt");
+            if (passwordFile.exists()) {
+                try (var fis = new FileInputStream(passwordFile)) {
+                    envpass = new String(fis.readAllBytes(), StandardCharsets.UTF_8);
+                }
+            } else {
+                envpass = AccessTokenGenerator.randomToken(16);
+                try (var fos = new FileOutputStream(passwordFile)) {
+                    fos.write(envpass.getBytes(StandardCharsets.UTF_8));
+                }
+            }
+        }
         Waifu2x waifu2x = new Waifu2x(envexec);
         threadPool(4, 1, -1);
         try {
@@ -31,11 +41,34 @@ public class App {
             System.exit(2);
         }
         MultipartConfigElement multipartConfigElement = new MultipartConfigElement("multipartTemp", maxFileSize, maxFileSize, maxFileSize+1);
-        String indexPage;
-        try (InputStream indexResource = App.class.getResourceAsStream("/app.html")) {
-            indexPage = new BufferedReader(new InputStreamReader(Objects.requireNonNull(indexResource))).lines().collect(Collectors.joining("\n"));
+        String indexPage, loginPage;
+        try (InputStream indexResource = App.class.getResourceAsStream("/app.html");
+             InputStream loginResource = App.class.getResourceAsStream("/login.html")) {
+            indexPage = new String(Objects.requireNonNull(indexResource).readAllBytes(), StandardCharsets.UTF_8);
+            loginPage = new String(Objects.requireNonNull(loginResource).readAllBytes(), StandardCharsets.UTF_8);
         }
-        get("/", (req, resp) -> indexPage);
+        String password = envpass;
+        get("/", (req, resp) -> {
+            if (password == null) {
+                return indexPage;
+            } else {
+                var loginValue = req.session().attribute("login");
+                return loginValue != null && (boolean) loginValue ? indexPage : loginPage;
+            }
+        });
+        post("/login", (req, resp) -> {
+            String submittedToken = req.queryParams("pass");
+            if (submittedToken == null) halt(400);
+            if (!submittedToken.equals(password)) return "Invalid password";
+            resp.redirect("/");
+            req.session().attribute("login", true);
+            return null;
+        });
+        post("/logout", (req, resp) -> {
+            resp.redirect("/");
+            req.session().attribute("login", false);
+            return null;
+        });
         post("/", (req, resp) -> {
             req.raw().setAttribute("org.eclipse.jetty.multipartConfig", multipartConfigElement);
             Part filePart, noisePart, typePart, scalePart;
diff --git a/src/main/resources/app.html b/src/main/resources/app.html
index b0ae190..d06f768 100644
--- a/src/main/resources/app.html
+++ b/src/main/resources/app.html
@@ -23,6 +23,9 @@
 </head>
 <body>
 <div id="childDiv">
+    <form action="/logout" method="post">
+        <input type="submit" value="logout">
+    </form>
     <h1>Waifu2xLemon</h1>
     <p>Simple web interface for waifu2x-ncnn-vulkan</p>
     <form action="/" method="post" enctype="multipart/form-data">
diff --git a/src/main/resources/login.html b/src/main/resources/login.html
new file mode 100644
index 0000000..8590441
--- /dev/null
+++ b/src/main/resources/login.html
@@ -0,0 +1,36 @@
+<!doctype html>
+
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, user-scalable=no">
+  <title>Waifu2xLemon</title>
+  <style>
+    * {
+      text-align: center;
+      font-family: monospace;
+    }
+    body, html {
+      background-color: #2d2d2d;
+      color: white;
+      height: 90vh;
+      display: grid;
+    }
+    #childDiv {
+      margin: auto;
+    }
+  </style>
+</head>
+<body>
+<div id="childDiv">
+  <h1>Waifu2xLemon</h1>
+  <p>Simple web interface for waifu2x-ncnn-vulkan</p>
+  <form action="/login" method="post">
+    <label for="pass">Password</label>
+    <br><input type="password" id="pass" name="pass" required>
+    <br><input type="submit" value="login" style="margin: 20px">
+  </form>
+  by ./lemon.sh
+</div>
+</body>
+</html>