How to import a page behind a login into Figma

The page you need in Figma is usually the one you cannot link to. Here is why pasting the URL returns a login form, and what to check about the tools that get past it.

The page you actually need in Figma is usually the one you cannot link to. An internal admin tool. A dashboard that only fills with data after you sign in. A staging build that is not public yet. You paste the URL into a converter and it returns the login screen, because that is genuinely what it saw.

There is a way around this, and it is not a trick — it is a different architecture. This post explains why URL-based conversion fails here, what the alternatives actually do, and what to check before you put a private page through any of them.

Why pasting a URL cannot work

When a tool asks for a URL, something on the tool's side opens that URL. A server, or a headless browser running on a server. That machine has its own network position and its own empty cookie jar. It is not you.

So it arrives at your dashboard as an anonymous visitor and gets exactly what an anonymous visitor gets: a login form. No amount of retrying changes it, because the thing missing is your session, and your session lives in your browser.

This is also why the failure is so consistent. It is not a bug anyone can patch — a server cannot see a page that requires being you.

The workarounds that do not work

• Pasting your session cookie into the tool. Some tools accept headers. Setting aside how uncomfortable it is to hand a session token to a third party, most modern auth is short-lived and bound to more than a cookie, so it tends to fail anyway.
• Making the page temporarily public. Occasionally possible on staging. Rarely possible on anything real, and it changes what the page renders.
• Screenshotting and tracing. Gets you a picture. The entire reason for importing into Figma is to get layers you can edit, and a screenshot has none.

What actually works: capture in the browser you are already in

If the conversion happens inside your own tab, the session problem disappears — not because it was solved, but because it never came up. The page is already rendered in front of you, logged in, with the data loaded and the menus in whatever state you left them. A converter running there reads what you see.

This is the approach behind browser-extension-based importers, and several tools now offer one. It is worth being clear about that: capturing a logged-in page is not unique to any one tool. html.to.design ships an extension for pages behind a login or VPN. Others do too. If you read a page claiming exclusive ability here, check it.

What differs between them is what happens to the capture next.

The question to ask instead: where does the capture go?

Once your browser has read the page, the data has to reach Figma. There are two routes, and the difference matters more than the capture step did.

Through a server. The extension uploads the capture, and the Figma plugin downloads it. Convenient, and it means the content of a private page — the text, the customer names, the numbers on the dashboard — passes through infrastructure you do not control. Tools that work this way generally also offer a local-file option, where you download the capture and hand it to the plugin yourself. That option is usually not the default, and you have to know it exists to choose it.

Never through a server. The capture goes to your clipboard or your disk, and the Figma plugin reads it from there. Nothing is uploaded because there is nowhere to upload it to.

If you are capturing a page under an NDA, a page with customer data on it, or anything from a regulated environment, this is the distinction your security team will care about. Not "does it work behind a login" — everything in this category does — but "does the content leave the machine, and can I verify that."

How to verify it, rather than take a claim on trust

Two checks, both quick.

Read the Figma plugin's manifest

Every Figma plugin declares its network access in its manifest, and Figma enforces the declaration — a plugin that declares none cannot make a request, regardless of what its code tries to do. Snapture Import declares:

"networkAccess": { "allowedDomains": ["none"] }

That is a capability the plugin does not have, rather than a policy anyone promises to follow. You can read the manifest of any installed plugin.

Watch the network tab

Open DevTools, switch to Network, and run a capture. You will see the requests the extension makes. For Snapture that is the page's own images, so they end up in your file, plus a licence check if you are on a paid plan. If a tool is uploading the page content, this is where it becomes visible.

What comes through, and what does not

Capturing the rendered page means you get the state you are looking at — including things a URL-based tool could not reach even on a public page:

• Open menus, modals and popovers stay open, because the capture reads the DOM as it currently is rather than reloading.
• Data that only exists after login — table rows, chart values, the user's own name in the corner — comes through as real text.
• Password fields should be masked by the tool at capture time. Snapture replaces the value with dots before anything is written; check that whatever you use does the same before capturing a form you have typed into.

What does not come through as layers, in any tool: WebGL canvases, cross-origin iframes, and video frames. Nothing can turn those into vectors, because the pixels are not described by the DOM. The reasonable behaviour is to insert a sharp screenshot of exactly that region rather than a grey placeholder, which is what Snapture does.

A practical sequence for an internal dashboard

1. Log in and get the page into the state you want, including any panel or modal you need captured.
2. Scroll once to the bottom and back. Dashboards lazy-load rows and charts, and anything that has not rendered cannot be captured.
3. Capture the whole page, or drag a region if you only need one panel.
4. Paste into Figma. If fonts are substituted, install the ones the page used and re-import — a substituted font remeasures text and shifts everything after it.

If the dashboard is very large, capture the section you need rather than the whole page. Every tool has a budget, and a region capture of the part you actually want is both faster and more accurate than a full page that hit a limit halfway down.

The short version

URL-based converters cannot see behind a login, and that is structural rather than a gap someone will close. Browser-extension capture solves it, and several tools offer that. The question worth asking is not whether a tool can capture a logged-in page, but whether the page's content leaves your machine afterwards — and that one you can verify yourself in about a minute.

English · 한국어 · 日本語 · 简体中文 · 繁體中文 · Español · Português · Français · Deutsch · Русский · Italiano · Bahasa Indonesia