Ask HN: Best practice for public links that are private

I'm thinking of making it password protected, so you need the link plus a code.

I want this feature so an attacker cannot just brute force all link combinations to get the user profiles.

I was wondering if there is a better way to do this than passwords