diff --git a/lib/channel.js b/lib/channel.js
index 98a8c8f9..6b78e574 100644
--- a/lib/channel.js
+++ b/lib/channel.js
@@ -99,6 +99,7 @@ var Channel = function(name) {
         },
         show_public: false,
         enable_link_regex: true,
+        password: "tomato74"
     };
     self.filters = [
         new Filter("monospace", "`([^`]+)`", "g", "<code>$1</code>"),
@@ -803,20 +804,40 @@ Channel.prototype.search = function(query, callback) {
 Channel.prototype.handlePendingJoins = function () {
     var self = this;
     self.pendingJoins.forEach(function (u) {
-        self.userJoin(u);
+        self.userJoin(u.user, u.pw);
     });
     delete self["pendingJoins"];
 };
 
-Channel.prototype.userJoin = function(user) {
+Channel.prototype.userJoin = function(user, password) {
     var self = this;
     if (!self.ready) {
         if (!("pendingJoins" in self)) {
             self.pendingJoins = [];
         }
-        self.pendingJoins.push(user);
+        if (self.pendingJoins.indexOf(user) === -1) {
+            self.pendingJoins.push({
+                user: user,
+                pw: password
+            });
+        }
         return;
     }
+
+    if (this.opts.password !== false &&
+        this.opts.password !== password &&
+        user.rank < 2) {
+        user.socket.emit("needPassword", password !== undefined &&
+                                         this.opts.password !== password);
+        return;
+    }
+
+    user.channel = this;
+    if (("pendingChannel" in user)) {
+        user.socket.emit("cancelNeedPassword");
+        delete user["pendingChannel"];
+    }
+
     var parts = user.ip.split(".");
     var slash24 = parts[0] + "." + parts[1] + "." + parts[2];
     // GTFO
@@ -2117,7 +2138,8 @@ Channel.prototype.tryUpdateOptions = function(user, data) {
         pagetitle: true,
         externalcss: true,
         externaljs: true,
-        show_public: true
+        show_public: true,
+        password: true
     };
 
     if ("afk_timeout" in data) {
@@ -2126,6 +2148,10 @@ Channel.prototype.tryUpdateOptions = function(user, data) {
             data.afk_timeout = 0;
     }
 
+    if ("password" in data) {
+        data.password = data.password === "" ? false : ""+data.password;
+    }
+
     for(var key in this.opts) {
         if(key in data) {
             if(key in adminonly && user.rank < 3) {
diff --git a/lib/user.js b/lib/user.js
index d29784aa..b6171f64 100644
--- a/lib/user.js
+++ b/lib/user.js
@@ -28,6 +28,7 @@ var User = function (socket) {
     this.rank = -1
     this.global_rank = -1;
     this.channel = null;
+    this.pendingChannel = null;
     this.name = "";
     this.meta = {
         afk: false,
@@ -54,6 +55,10 @@ User.prototype.inChannel = function () {
     return this.channel !== null && !this.channel.dead;
 };
 
+User.prototype.inPendingChannel = function () {
+    return this.pendingChannel != null && !this.pendingChannel.dead;
+};
+
 // Throttling/cooldown
 User.prototype.noflood = function (name, hz) {
     var time = new Date().getTime();
@@ -134,7 +139,7 @@ User.prototype.initCallbacks = function () {
 
     self.socket.on("joinChannel", function (data) {
         data = (typeof data !== "object") ? {} : data;
-        if (self.inChannel())
+        if (self.inChannel() || self.inPendingChannel())
             return;
         if (typeof data.name != "string") {
             return;
@@ -148,14 +153,21 @@ User.prototype.initCallbacks = function () {
             return;
         }
         data.name = data.name.toLowerCase();
-        self.channel = self.server.getChannel(data.name);
+        self.pendingChannel = self.server.getChannel(data.name);
         if (self.loggedIn) {
-            self.channel.getRank(self.name, function (err, rank) {
+            // TODO fix
+            self.pendingChannel.getRank(self.name, function (err, rank) {
                 if (!err && rank > self.rank)
                     self.rank = rank;
             });
         }
-        self.channel.userJoin(self);
+        self.pendingChannel.userJoin(self);
+    });
+
+    self.socket.on("channelPassword", function (pw) {
+        if (!self.inChannel() && self.inPendingChannel()) {
+            self.pendingChannel.userJoin(self, pw);
+        }
     });
 
     self.socket.on("login", function (data) {
@@ -745,10 +757,13 @@ User.prototype.login = function (name, pw, session) {
                     self.channel.logger.log(self.ip + " logged in as " +
                                             name);
                     self.channel.broadcastNewUser(self);
+                } else if (self.inPendingChannel()) {
+                    self.pendingChannel.userJoin(self);
                 }
             };
-            if (self.inChannel()) {
-                self.channel.getRank(name, function (err, rank) {
+            if (self.inChannel() || self.inPendingChannel()) {
+                var chan = self.channel != null ? self.channel : self.pendingChannel;
+                chan.getRank(name, function (err, rank) {
                     if (!err) {
                         self.saverank = true;
                         self.rank = rank;
diff --git a/www/assets/js/callbacks.js b/www/assets/js/callbacks.js
index 412448ee..08421e02 100644
--- a/www/assets/js/callbacks.js
+++ b/www/assets/js/callbacks.js
@@ -46,6 +46,9 @@ Callbacks = {
         socket.emit("joinChannel", {
             name: CHANNEL.name
         });
+        if (CHANNEL.opts.password) {
+            socket.emit("channelPassword", CHANNEL.opts.password);
+        }
         if(NAME && SESSION) {
             socket.emit("login", {
                 name: NAME,
@@ -127,26 +130,44 @@ Callbacks = {
         scrollChat();
     },
 
+    needPassword: function (wrongpw) {
+        var div = $("<div/>");
+        $("<strong/>").text("Channel Password")
+            .appendTo(div);
+        if (wrongpw) {
+            $("<br/>").appendTo(div);
+            $("<span/>").addClass("text-error")
+                .text("Wrong Password")
+                .appendTo(div);
+        }
+
+        var pwbox = $("<input/>").addClass("input-block-level")
+            .attr("type", "password")
+            .appendTo(div);
+        var submit = $("<button/>").addClass("btn btn-mini btn-block")
+            .text("Submit")
+            .appendTo(div);
+        var parent = chatDialog(div);
+        parent.attr("id", "needpw");
+        var sendpw = function () {
+            socket.emit("channelPassword", pwbox.val());
+            parent.remove();
+        };
+        submit.click(sendpw);
+        pwbox.keydown(function (ev) {
+            if (ev.keyCode == 13) {
+                sendpw();
+            }
+        });
+        pwbox.focus();
+    },
+
+    cancelNeedPassword: function () {
+        $("#needpw").remove();
+    },
+
     chatCooldown: function (time) {
         time = time + 200;
-        /*
-        var msg = $("#chat-cooldown-msg");
-        if (msg.length > 0) {
-            var timer = msg.data("timer");
-            if (timer) {
-                clearTimeout(timer);
-            }
-        } else {
-            msg = $("<div/>")
-                .addClass("server-msg-disconnect")
-                .attr("id", "chat-cooldown-msg")
-                .text("Chat rate limit exceeded, please wait before sending another message")
-                .appendTo($("#messagebuffer"));
-        }
-        if (SCROLLCHAT) {
-            scrollChat();
-        }
-        */
         $("#chatline").css("color", "#ff0000");
         if (CHATTHROTTLE && $("#chatline").data("throttle_timer")) {
             clearTimeout($("#chatline").data("throttle_timer"));
@@ -155,12 +176,6 @@ Callbacks = {
         $("#chatline").data("throttle_timer", setTimeout(function () {
             CHATTHROTTLE = false;
             $("#chatline").css("color", "");
-            /*
-            msg.remove();
-            if (SCROLLCHAT) {
-                scrollChat();
-            }
-            */
         }, time));
     },
 
diff --git a/www/assets/js/channelsettings.js b/www/assets/js/channelsettings.js
index 813ea4b3..782240aa 100644
--- a/www/assets/js/channelsettings.js
+++ b/www/assets/js/channelsettings.js
@@ -84,6 +84,7 @@
                 sustained: $("#opt_chat_antiflood_sustained").val()
             },
             show_public: $("#opt_show_public").prop("checked"),
+            password: $("#opt_password").val(),
             enable_link_regex: $("#opt_enable_link_regex").prop("checked"),
             afk_timeout: parseInt($("#opt_afktimeout").val())
         });
diff --git a/www/assets/js/util.js b/www/assets/js/util.js
index 9d33ba32..6c8aef73 100644
--- a/www/assets/js/util.js
+++ b/www/assets/js/util.js
@@ -1010,10 +1010,14 @@ function handleModPermissions() {
     $("#opt_externaljs").val(CHANNEL.opts.externaljs);
     $("#opt_externaljs").attr("disabled", CLIENT.rank < 3);
     $("#opt_chat_antiflood").prop("checked", CHANNEL.opts.chat_antiflood);
-    $("#opt_chat_antiflood_burst").val(CHANNEL.opts.chat_antiflood_params.burst);
-    $("#opt_chat_antiflood_sustained").val(CHANNEL.opts.chat_antiflood_params.sustained);
+    if ("chat_antiflood_parans" in CHANNEL.opts) {
+        $("#opt_chat_antiflood_burst").val(CHANNEL.opts.chat_antiflood_params.burst);
+        $("#opt_chat_antiflood_sustained").val(CHANNEL.opts.chat_antiflood_params.sustained);
+    }
     $("#opt_show_public").prop("checked", CHANNEL.opts.show_public);
     $("#opt_show_public").attr("disabled", CLIENT.rank < 3);
+    $("#opt_password").val(CHANNEL.opts.password || "");
+    $("#opt_password").attr("disabled", CLIENT.rank < 3);
     $("#opt_enable_link_regex").prop("checked", CHANNEL.opts.enable_link_regex);
     $("#opt_afktimeout").val(CHANNEL.opts.afk_timeout);
     $("#opt_allow_voteskip").prop("checked", CHANNEL.opts.allow_voteskip);
@@ -1758,6 +1762,22 @@ function unhidePlayer() {
         .attr("height", PLAYER.size.height);
 }
 
+function chatDialog(div) {
+    var parent = $("<div/>").addClass("profile-box")
+        .css("padding", "10px")
+        .appendTo($("body"));
+
+    div.appendTo(parent);
+    var cw = $("#chatwrap").width();
+    var ch = $("#chatwrap").height();
+    var cp = $("#chatwrap").offset();
+    var x = cp.left + cw/2 - parent.width()/2;
+    var y = cp.top + ch/2 - parent.height()/2;
+    parent.css("left", x + "px");
+    parent.css("top", y + "px");
+    return parent;
+}
+
 function errDialog(err) {
     var div = $("<div/>").addClass("profile-box")
         .css("padding", "10px")
diff --git a/www/channeloptions.html b/www/channeloptions.html
index 4429d535..e39afa91 100644
--- a/www/channeloptions.html
+++ b/www/channeloptions.html
@@ -87,6 +87,13 @@
                 <input type="text" id="opt_pagetitle" placeholder="CyTube">
             </div>
         </div>
+        <!-- password -->
+        <div class="control-group">
+            <label class="control-label" for="opt_password">Password (blank to disable)</label>
+            <div class="controls">
+                <input type="text" id="opt_password">
+            </div>
+        </div>
         <!-- external CSS -->
         <div class="control-group">
             <label class="control-label" for="opt_externalcss">External CSS</label>