diff --git a/html/src/app.js b/html/src/app.js
index 24c95592..c28398c5 100644
--- a/html/src/app.js
+++ b/html/src/app.js
@@ -434,7 +434,7 @@ speechSynthesis.getVoices();
             })
             .then(({data, status}) => {
                 if (status === 200) {
-                    if (data.success === Object(data.success)) {
+                    if (data && data.success === Object(data.success)) {
                         new Noty({
                             type: 'success',
                             text: escapeTag(data.success.message)
@@ -472,13 +472,13 @@ speechSynthesis.getVoices();
                 ) {
                     this.expireNotification(init.inviteId);
                 }
-                if (data.error === Object(data.error)) {
+                if (data && data.error === Object(data.error)) {
                     this.$throw(
                         data.error.status_code || status,
                         data.error.message,
                         endpoint
                     );
-                } else if (typeof data.error === 'string') {
+                } else if (data && typeof data.error === 'string') {
                     this.$throw(
                         data.status_code || status,
                         data.error,
@@ -680,7 +680,8 @@ speechSynthesis.getVoices();
             hiddenId: null,
             privateId: null,
             friendsId: null,
-            canRequestInvite: false
+            canRequestInvite: false,
+            strict: false
         };
         if (_tag === 'offline') {
             ctx.isOffline = true;
@@ -707,6 +708,8 @@ speechSynthesis.getVoices();
                             ctx.canRequestInvite = true;
                         } else if (key === 'region') {
                             ctx.region = value;
+                        } else if (key === 'strict') {
+                            ctx.strict = true;
                         }
                     } else {
                         ctx.instanceName = s;
@@ -807,7 +810,7 @@ speechSynthesis.getVoices();
 
     Vue.component('location', {
         template:
-            '<span @click="showWorldDialog" :class="{ \'x-link\': link && this.location !== \'private\' && this.location !== \'offline\'}">{{ text }}<slot></slot><span class="famfamfam-flags" :class="region" style="display:inline-block;margin-left:5px"></span></span>',
+            '<span @click="showWorldDialog" :class="{ \'x-link\': link && this.location !== \'private\' && this.location !== \'offline\'}">{{ text }}<slot></slot><span class="famfamfam-flags" :class="region" style="display:inline-block;margin-left:5px"></span><i v-if="strict" class="el-icon el-icon-lock" style="display:inline-block;margin-left:5px"></i></span>',
         props: {
             location: String,
             hint: {
@@ -822,7 +825,8 @@ speechSynthesis.getVoices();
         data() {
             return {
                 text: this.location,
-                region: this.region
+                region: this.region,
+                strict: this.strict
             };
         },
         methods: {
@@ -877,6 +881,7 @@ speechSynthesis.getVoices();
                         this.region = 'flag-icon-usw';
                     }
                 }
+                this.strict = L.strict;
             },
             showWorldDialog() {
                 if (this.link) {
@@ -1918,6 +1923,9 @@ speechSynthesis.getVoices();
 
     API.$on('INSTANCE', function (args) {
         var {json} = args;
+        if (!json) {
+            return;
+        }
         var D = $app.userDialog;
         if ($app.userDialog.visible && D.ref.location === json.id) {
             D.instance.occupants = json.n_users;
@@ -1926,6 +1934,9 @@ speechSynthesis.getVoices();
 
     API.$on('INSTANCE', function (args) {
         var {json} = args;
+        if (!json) {
+            return;
+        }
         var D = $app.worldDialog;
         if ($app.worldDialog.visible && $app.worldDialog.id === json.worldId) {
             for (var instance of D.rooms) {
@@ -14583,6 +14594,7 @@ speechSynthesis.getVoices();
         userId: '',
         accessType: '',
         region: '',
+        strict: false,
         location: '',
         url: ''
     };
@@ -14600,12 +14612,10 @@ speechSynthesis.getVoices();
         } else {
             tags.push((99999 * Math.random() + 1).toFixed(0));
         }
-        if (D.userId) {
-            var userId = D.userId;
-        } else {
+        if (!D.userId) {
             D.userId = API.currentUser.id;
-            var userId = API.currentUser.id;
         }
+        var userId = D.userId;
         if (D.accessType !== 'public') {
             if (D.accessType === 'friends+') {
                 tags.push(`~hidden(${userId})`);
@@ -14630,6 +14640,12 @@ speechSynthesis.getVoices();
         if (D.accessType !== 'public') {
             tags.push(`~nonce(${uuidv4()})`);
         }
+        if (D.accessType !== 'invite' && D.accessType !== 'friends') {
+            D.strict = false;
+        }
+        if (D.strict) {
+            tags.push('~strict');
+        }
         D.instanceId = tags.join('');
     };
 
@@ -14681,6 +14697,10 @@ speechSynthesis.getVoices();
                 this.newInstanceDialog.userId
             );
         }
+        configRepository.setBool(
+            'instanceDialogStrict',
+            this.newInstanceDialog.strict
+        );
         $app.buildInstance();
         updateLocationURL();
     };
@@ -14689,6 +14709,7 @@ speechSynthesis.getVoices();
     $app.watch['newInstanceDialog.accessType'] = saveNewInstanceDialog;
     $app.watch['newInstanceDialog.region'] = saveNewInstanceDialog;
     $app.watch['newInstanceDialog.userId'] = saveNewInstanceDialog;
+    $app.watch['newInstanceDialog.strict'] = saveNewInstanceDialog;
 
     $app.methods.showNewInstanceDialog = function (tag) {
         this.$nextTick(() => adjustDialogZ(this.$refs.newInstanceDialog.$el));
@@ -14718,6 +14739,10 @@ speechSynthesis.getVoices();
         if (configRepository.getString('instanceDialogUserId') !== null) {
             D.userId = configRepository.getString('instanceDialogUserId');
         }
+        D.strict = false;
+        if (configRepository.getBool('instanceDialogStrict') !== null) {
+            D.strict = configRepository.getBool('instanceDialogStrict');
+        }
         this.buildInstance();
         D.visible = true;
     };
@@ -14906,10 +14931,12 @@ speechSynthesis.getVoices();
         D.shortUrl = '';
         D.url = getLaunchURL(L.worldId, L.instanceId);
         D.visible = true;
-        API.getInstanceShortName({
-            worldId: L.worldId,
-            instanceId: L.instanceId
-        });
+        if (L.accessType === 'public' || L.userId === API.currentUser.id) {
+            API.getInstanceShortName({
+                worldId: L.worldId,
+                instanceId: L.instanceId
+            });
+        }
     };
 
     $app.methods.locationToLaunchArg = function (location) {
diff --git a/html/src/index.pug b/html/src/index.pug
index d64a5b47..809c8637 100644
--- a/html/src/index.pug
+++ b/html/src/index.pug
@@ -94,6 +94,7 @@ html
                                     span.famfamfam-flags(v-else-if="currentInstanceLocation.region === 'jp'" class="jp" style="display:inline-block;margin-left:5px")
                                     span.flag-icon-use(v-else-if="currentInstanceLocation.region === 'use'" style="display:inline-block;margin-left:5px")
                                     span.flag-icon-usw(v-else style="display:inline-block;margin-left:5px")
+                                    i.el-icon-lock(v-if="currentInstanceLocation.strict" style="display:inline-block;margin-left:5px")
                                 span(v-if="lastLocation.playerList.size > 0" style="margin-left:5px")
                                     | {{ lastLocation.playerList.size }}
                                     | #[template(v-if="lastLocation.friendList.size > 0") ({{ lastLocation.friendList.size }})]
@@ -1650,6 +1651,7 @@ html
                                         span.famfamfam-flags(v-else-if="room.$location.region === 'jp'" class="jp" style="display:inline-block;margin-left:5px")
                                         span.flag-icon-use(v-else-if="room.$location.region === 'use'" style="display:inline-block;margin-left:5px")
                                         span.flag-icon-usw(v-else style="display:inline-block;margin-left:5px")
+                                        i.el-icon-lock(v-if="room.$location.strict" style="display:inline-block;margin-left:5px")
                                     el-tooltip(placement="top" content="Invite yourself" :disabled="hideTooltips")
                                         invite-yourself(:location="room.$location.tag" style="margin-left:5px")
                                     el-tooltip(placement="top" content="Copy to clipboard" :disabled="hideTooltips")
@@ -1939,6 +1941,8 @@ html
                             el-radio-button(label="friends")
                             el-radio-button(label="invite+")
                             el-radio-button(label="invite")
+                    el-form-item(label="Strict" v-if="newInstanceDialog.accessType === 'friends' || newInstanceDialog.accessType === 'invite'")
+                        el-checkbox(v-model="newInstanceDialog.strict") Prevent non friends joining via URL/Instance ID
                     el-form-item(label="Region")
                         el-radio-group(v-model="newInstanceDialog.region" size="mini" @change="buildInstance")
                             el-radio-button(label="US West")
@@ -1948,7 +1952,7 @@ html
                     el-form-item(label="World ID")
                         el-input(v-model="newInstanceDialog.worldId" size="mini" @click.native="$event.target.tagName === 'INPUT' && $event.target.select()")
                     el-form-item(label="Instance ID")
-                        el-input(v-model="newInstanceDialog.instanceName" maxlength="16" placeholder="Random" show-word-limit size="mini" @click.native="$event.target.tagName === 'INPUT' && $event.target.select()")
+                        el-input(v-model="newInstanceDialog.instanceName" placeholder="Random" size="mini" @click.native="$event.target.tagName === 'INPUT' && $event.target.select()")
                     el-form-item(label="Instance Creator")
                         el-select(v-model="newInstanceDialog.userId" clearable placeholder="Choose User" filterable style="width:100%")
                             el-option-group(v-if="API.currentUser" label="ME")
@@ -2778,6 +2782,7 @@ html
                                 span.famfamfam-flags(v-else-if="scope.row.$location.region === 'jp'" class="jp" style="display:inline-block;margin-left:5px")
                                 span.flag-icon-use(v-else-if="scope.row.$location.region === 'use'" style="display:inline-block;margin-left:5px")
                                 span.flag-icon-usw(v-else style="display:inline-block;margin-left:5px")
+                                i.el-icon-lock(v-if="scope.row.$location.strict" style="display:inline-block;margin-left:5px")
                     el-table-column(label="Instance Creator" prop="location")
                         template(v-once #default="scope")
                             span.x-link(v-text="getDisplayNameFromUserId(scope.row.$location.userId)" @click="showUserDialog(scope.row.$location.userId)" style="cursor:pointer")