[asm]

That you're asking about keeping it unguessable makes me think that it feels like too few. Its actually only 5 bytes of random (the first character is always zero). 2^40 is a pretty large number and I don't expect to get high coverage over that space any time soon. That being said, perception is important, so I should probably up it.

As for hot-linking; I have no business plan and just wanted to make something useful. I should probably figure that stuff out.

[solistice]

I'd just put up a nice, flat lock somewhere when uploading. If it's locked, pop up a text box where the user can enter a password. If it's open, just do what you do right now.

I personally think a freemium kind of model will work best for a service like this. Allow locking only for logged in users, and give each person 30 locks for free monthly (1 per day on average). For additional locks, either charge a small fee out of the user account (something under a dollar), or charge a given amount monthly for flatrate locks. You should allow people to deposit money into their user account in order to pay for these things. They'll most likely consider it playmoney, and that lowers inhibitions when it comes to buying premium features.