World Anvil Secrets: Player Permissions That Work

You've spent hours building your world in World Anvil. NPCs have backstories. Locations have histories. Your villain's grand plan spans three nested documents with timeline entries and relationship maps. Then your player clicks a link during the session and reads the entire conspiracy before you've revealed the first clue.

World Anvil has the tools to prevent this. The problem is that the permissions system offers multiple approaches, each with different strengths, and the documentation assumes you already know which one you need. You don't want to rebuild your entire world after choosing wrong.

This guide walks through how secrets, subscriber groups, and visibility toggles actually work, when to use each, and how to set up a permissions structure that scales from a single party to multiple campaigns.

The Three Permission Systems

World Anvil gives you three ways to control what players see: article privacy, secrets, and visibility toggles. Each solves a different problem.

Article privacy controls whether an entire article is public, private, or restricted to subscribers. If an NPC article is private, nobody outside your subscriber list sees it at all. Simple, but blunt. You can't show players the shopkeeper's name and appearance while hiding their secret allegiance to the thieves' guild.

Secrets are chunks of content you create separately and embed into articles. A secret can appear in multiple places, and each secret can be visible to different subscriber groups. The shopkeeper's public information lives in the main article; their criminal connections live in a secret that only you (and eventually, the rogue who discovers the truth) can see.

Visibility toggles let you hide sections of an article from all readers at once. When you toggle a section visible, everyone with access to the article sees it. You lose the granularity of showing different things to different players, but you gain speed. Mid-session reveals become a single click.

Secrets: The Workhorse System

Secrets do the heavy lifting in most D&D campaigns. They let you write complete articles, from every angle, without worrying about spoilers, then control exactly what each player group can read.

Creating Your First Secret

Open the Secrets panel from the left sidebar and click "+ Secret" at the bottom. Give the secret a clear name; you'll be managing dozens of these eventually, so "Blackwood's Real Identity" beats "Secret 1."

Write the content. This can include BBCode formatting, links to other articles, images. Anything you'd put in a regular article works inside a secret.

By default, only you can see the secret. It won't appear anywhere until you embed it in an article or attach it to one.

Embedding vs. Attaching Secrets

Embedding places the secret's content directly in the article body, visible inline to anyone with permission. Click the clipboard icon next to your secret in the sidebar and paste the code wherever you want the text to appear. To readers without permission, that section simply doesn't exist. No blank space, no "hidden content" message. The article reads as if those paragraphs were never written.

Attaching adds the secret to a tab at the bottom of the article. Attached secrets are visible to you in the metadata section, but players won't see the tab unless they have permission to view at least one secret in it. Use attached secrets for GM notes you reference during prep, information players will never need, or supplementary details that would clutter the main text.

If you create a secret from within an article (rather than from the main Secrets panel), it automatically attaches to that article. You can still embed it elsewhere, but the attachment is already in place.

Reusing Secrets Across Articles

Here's where secrets become powerful. The same secret can embed in multiple articles. Your thieves' guild operates across the city. The "Guild Operations" secret can appear in the harbor article, the warehouse district article, and three different NPC profiles. When your players finally uncover the conspiracy, you update the subscriber group on one secret, and the information appears everywhere it's relevant.

Without secrets, you'd need to edit every article individually. With them, you manage the reveal once.

Subscriber Groups: Who Sees What

Secrets without subscriber groups are just private notes. Subscriber groups are how you share specific secrets with specific people.

Setting Up Groups

Navigate to your world settings and find the Subscribers section. Create groups based on who needs different information. For a typical campaign, start with:

The Party. One group containing all current players. Most secrets your players discover together go here. When the party learns the duke is corrupt, add them to the "Duke Conspiracy" secret's subscriber group, and everyone sees it.

Individual character groups. The rogue's backstory might connect to an assassin's guild. The cleric might receive visions only they witness. Create a group for each player who has access to information the others don't. This seems like overkill until the moment one player's private knowledge becomes the session's central drama.

Former party members. When players leave a campaign or characters die, move them to a separate group. They keep access to what they discovered, but new secrets don't propagate to them.

Assigning Groups to Secrets

Open any secret and click the group icon. Select which subscriber groups can see this content. A secret can belong to multiple groups. Your "Guild Operations" secret might be visible to both the full party (who discovered the guild's existence) and the rogue's individual group (who knows additional details from their backstory).

Remember: subscribers need World Anvil accounts. Free accounts work. Your players don't need paid memberships to read subscriber content. They just need to be logged in and added to your group.

Subscriber Limits by Tier

Your World Anvil membership determines how many individual subscribers you can have across all groups. Journeyman allows 5 subscribers. Master allows 10. Grandmaster allows 100. Sage allows 1,000.

Each person counts once, regardless of how many groups they belong to. A player in three different subscriber groups still counts as one subscriber toward your limit.

For most single-campaign GMs, Master tier handles a party of six with room for a few extra accounts. If you're running multiple campaigns or have a large player community, Grandmaster becomes necessary.

Visibility Toggles: Quick Reveals

Visibility toggles take a different approach. Instead of creating separate secret objects, you mark sections of an existing article as hidden. When you toggle them visible, everyone with access sees the content.

When Toggles Beat Secrets

Use visibility toggles when you want to reveal information to everyone at once during a session. The merchant's back room is locked. Players can see the shop description but not what's behind the door. When they pick the lock, you toggle the back room section visible, and everyone sees it immediately.

Toggles are faster to set up than secrets for simple hidden content. You don't need to create a separate object, manage subscriber groups, or track which secrets live where. The toggle lives in the article, and you flip it when ready.

When Secrets Beat Toggles

Toggles lack granularity. You can't show the back room to one player and hide it from another. If the rogue scouts ahead alone, toggles force you to either reveal to everyone or describe verbally and hope players separate character knowledge from player knowledge.

Toggles also don't work for content that appears in multiple places. If that back room connects to a secret tunnel mentioned in three other articles, you need secrets with subscriber groups to manage the reveal coherently.

Finding and Using Toggles

Visibility toggles appear in presentation view, not edit mode. View your article as readers would see it, and you'll find the toggle controls. This trips up many GMs who search through the editor looking for the feature.

Visibility toggles require Grandmaster tier or above. If you're on a lower tier and need session-based reveals, secrets with a "Revealed" subscriber group can approximate the same workflow, though with more setup overhead.

Building Your Permission Structure

Start simple and add complexity when you need it. Here's a structure that scales from one-shots to long campaigns.

Initial Setup

Create two subscriber groups: "Current Party" and "GM Only." Add all players to Current Party. Add yourself to GM Only (or keep it empty; you always see your own secrets).

When you write an article, put public information in the main body. Embed secrets for anything players might discover during play, assigning them to no groups initially. Attach GM-only notes (session prep, future plot hooks, meta information) as secrets visible to no one or to your GM Only group.

Handling Discoveries

When the party discovers hidden information, add "Current Party" to that secret's subscriber groups. The content immediately appears in any article where you've embedded that secret.

When one player discovers something alone, create a player-specific group (if you haven't already) and add only that secret. Other party members continue seeing the article without the hidden section.

Managing Multiple Campaigns

If you run multiple games in the same world, subscriber groups become organizational necessities. Create a group for each campaign's party. Information about the northern kingdom goes to Campaign A, southern territories to Campaign B. Overlapping elements (world history, major factions, pantheon details) go to a shared group or remain public.

Be deliberate about cross-campaign secrets. If Campaign A's actions affect Campaign B's world state, you'll need a system for when and how that information propagates. Some GMs maintain separate "World Events" secrets that update as the timeline progresses.

Common Problems and Fixes

Players Can See Secrets They Shouldn't

Check whether you have "Open Secrets" enabled in your world settings. Open Secrets makes all secrets visible to co-authors and editors, bypassing subscriber groups. Useful for collaborative worldbuilding, but problematic if your players have editing rights for their character pages.

If a player needs to edit their own character article, keep Open Secrets off and use subscriber groups for intentional sharing.

Secrets Not Appearing Where Expected

Verify the secret is embedded, not just attached. Attached secrets appear in the metadata tab, not the article body. If you want text to appear inline, you need the embed code pasted into the article content.

Also check that your subscriber groups are correctly assigned to both the secret and the players who should see it. A missing link in either direction hides the content.

Permission Changes Don't Propagate

World Anvil caches aggressively. After changing subscriber group access, have players refresh the page or log out and back in. If content still doesn't appear, verify the player's account is correctly added to the subscriber group in your world settings.

Too Many Secrets to Manage

Naming conventions matter at scale. Use prefixes: "NPC-Blackwood-True Identity," "LOC-Harbor-Smuggler Tunnels," "PLOT-Duke Conspiracy-Phase 2." When you're searching through 200 secrets mid-session, consistent naming saves minutes.

Periodically archive old secrets. Content from completed story arcs can move to an "Archive" subscriber group. The information stays accessible for reference, but doesn't clutter your active lists.

Workflow for Session Prep

Before each session, identify which secrets might be discovered and confirm they're ready to reveal. Check that embed codes are in place, subscriber groups are set, and you know which group to add when the moment arrives.

During play, keep your subscriber management open in a browser tab. When players discover information, add the appropriate group immediately. Waiting until after the session leads to forgotten updates and confused players who can't find "that thing you showed us last week."

After each session, update secrets with any new information players shared or revealed to each other. If the rogue told the party about the assassin's guild, move that secret to the party group. Player-to-player reveals often happen faster than GM-to-player ones, and your permission structure should reflect what's actually known.

The Philosophy Behind Permissions

Permissions exist to enable play, not restrict it. The goal isn't maximum secrecy. It's maximum engagement. Players should be able to browse your world freely without stumbling into spoilers. They should find rich detail about what their characters know and intriguing gaps where mysteries wait.

A well-structured World Anvil site invites exploration. Players click through articles, following connections, building their own understanding of your world. Permissions let you write for that exploration. Every article can be complete from your perspective, containing everything relevant, while players see only what their characters have earned.

Build your permission structure to support this. When in doubt, make something a secret you can reveal later rather than public content you'll regret sharing. Revelation is dramatic. Redaction is awkward. Design your world for the reveals.