diff --git a/README.md b/README.md
index 0947fba..3f29a07 100644
--- a/README.md
+++ b/README.md
@@ -6,10 +6,11 @@ personal diary with txt style, can be private!
 
 ## environment variables
 
-|     name      |  description  | required |
-| :-----------: | :-----------: | :------: |
-| `TD_USERNAME` |   user name   |    no    |
-| `TD_USERPASS` | user password |   yes    |
+|     name      |  description  |    required     |
+| :-----------: | :-----------: | :-------------: |
+| `TD_USERNAME` |   user name   |       no        |
+| `TD_USERPASS` | user password |       yes       |
+| `TD_PRIVATE`  | user password | empty = `false` |
 
 ## volumes (docker)
 
diff --git a/src/routes/index.py b/src/routes/index.py
index 5f8a64c..189dc6a 100644
--- a/src/routes/index.py
+++ b/src/routes/index.py
@@ -10,11 +10,15 @@ router = Blueprint(name, __name__)
 @router.route("/")
 def index() -> str:
     """index page"""
+    posts = []
+    if not Config.private or (Config.private and Config.is_logged()):
+        posts = [p.split("/")[-1][:-4] for p in get_posts()]
+
     return render_template(
         "index.html",
         config=Config,
         page_name=name,
-        posts=[p.split("/")[-1][:-4] for p in get_posts()],
+        posts=posts,
     )
 
 
diff --git a/src/routes/read.py b/src/routes/read.py
index f8370f9..2a7c73d 100644
--- a/src/routes/read.py
+++ b/src/routes/read.py
@@ -10,8 +10,10 @@ router = Blueprint(name, __name__)
 @router.route(f"/{name}/<int:file>")
 def read(file: int) -> str:
     """read page"""
-    filename = post_filename(file)
-    content = get_post(filename)
+    content = None
+    if not Config.private or (Config.private and Config.is_logged()):
+        filename = post_filename(file)
+        content = get_post(filename)
 
     return render_template(
         "read.html",
diff --git a/src/utils/config.py b/src/utils/config.py
index 196153a..733e3c0 100644
--- a/src/utils/config.py
+++ b/src/utils/config.py
@@ -4,6 +4,7 @@ from flask import session
 
 VAR_USERNAME = "TD_USERNAME"
 VAR_USERPASS = "TD_USERPASS"
+VAR_PRIVATE = "TD_PRIVATE"
 
 
 class User:
@@ -34,6 +35,9 @@ class Config:
     # data location
     data_dir = "data"
 
+    # turn posts private
+    private = True if VAR_PRIVATE in envar else False
+
     @staticmethod
     def is_logged() -> bool:
         """where the info about connection is stored"""