diff --git a/README.md b/README.md
index 83903af..d1a00b3 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,7 @@ Practice Japanese Karaoke lyrics reading and typing at the same time with amaoke
 * [ ] Allow users to correct lyric pronunciations through correction feedback
 * [ ] Correct lyrics timing inconsistencies (i.e. 网易云的歌词因为是业余用户上传的，时间戳不一定准确。但是 waveform 里面可以分析出每段人声的具体开始结束时间，也许可以自动修正)
 * [x] Processing lyrics and audio should be parallel
-* [ ] Add admin password to admin pages
+* [x] Add admin password to admin pages
 * [x] About page
 * [ ] Intro popup
 * [ ] Re-encode songs using opus
diff --git a/src/lib/client.ts b/src/lib/client.ts
index f72ab60..8f54b4f 100644
--- a/src/lib/client.ts
+++ b/src/lib/client.ts
@@ -25,7 +25,7 @@ export const API = {
     netease: {
         startImport: async (link: string) => await post('/api/import/netease/start', { link }),
         checkProgress: async (id: string) => await post('/api/import/netease/progress', { id }),
-        checkLogin: async () => await post('/admin/netease-login', {})
+        checkLogin: async (pwd?: string) => await post('/admin/netease-login', { pwd })
     },
 
     user: {
diff --git a/src/routes/admin/netease-login/+page.svelte b/src/routes/admin/netease-login/+page.svelte
index 45f8750..93bc46f 100644
--- a/src/routes/admin/netease-login/+page.svelte
+++ b/src/routes/admin/netease-login/+page.svelte
@@ -9,6 +9,7 @@ This page is vibe-coded. It's not a part of the regular UI intended for users an
 -->
 <script lang="ts">
     import { onDestroy, onMount } from 'svelte';
+    import { page } from '$app/stores';
     import { API } from '$lib/client';
     import { fade, scale } from 'svelte/transition';
     import AppBar from "$lib/ui/appbar/AppBar.svelte";
@@ -23,7 +24,8 @@ This page is vibe-coded. It's not a part of the regular UI intended for users an
 
     async function check() {
         try {
-            const res = await API.netease.checkLogin();
+            const pwd = $page.url.searchParams.get('pwd') ?? undefined;
+            const res = await API.netease.checkLogin(pwd);
             if (res.code === 801) {
                 if (status !== 'waiting_scan') {
                     status = 'waiting_scan';
diff --git a/src/routes/admin/netease-login/+server.ts b/src/routes/admin/netease-login/+server.ts
index 99880ae..5fb02d7 100644
--- a/src/routes/admin/netease-login/+server.ts
+++ b/src/routes/admin/netease-login/+server.ts
@@ -1,5 +1,6 @@
 import * as ne from '@neteasecloudmusicapienhanced/api'
 import { error, json } from '@sveltejs/kit'
+import { env } from '$env/dynamic/private'
 import { loginWithSyncCode } from '$lib/server/user'
 import type { RequestHandler } from './$types'
 import { db } from '$lib/server/db'
@@ -15,6 +16,11 @@ async function createQr() {
 }
 
 export const POST: RequestHandler = async ({ request, cookies }) => {
+  const { pwd } = await request.json().catch(() => ({}))
+  if (env.ADMIN_PASSWORD && pwd !== env.ADMIN_PASSWORD) {
+    throw error(403, 'Invalid password')
+  }
+
   if (!globalSession.key) await createQr()
 
   // Check key validity