How to Password Protect a PDF

Add a password to a PDF with AES-256 encryption in your browser. Learn how PDF passwords work, how to choose a strong one and how to remove it later.

How PDF password protection works

PDF files support two kinds of passwords. A user password, often called an open password, is required to open the document at all. Without it, the contents are encrypted and unreadable. An owner password, sometimes called a permissions password, controls restrictions such as printing, copying or editing. Owner restrictions are only honored by cooperating PDF software, so on their own they offer little real protection.

The strength of an open password depends on the encryption method. Older PDFs used RC4 or 40-bit keys that can be broken quickly with modern hardware. Current PDF software supports AES with a 256-bit key, defined in the PDF 2.0 standard, which is the strongest option available in the format. With AES-256, the realistic way into the file is guessing the password, so the password itself is what you need to get right.

What Protect PDF does

Protect PDF encrypts your document with AES-256 using the open-source QPDF library, compiled to WebAssembly and running inside your browser. The file and the password never leave your device. The tool sets an open password that anyone must enter to view the document. It also generates a long random owner password internally, but it does not add printing or copying restrictions: once someone opens the file with your password, they can use it normally.

This approach matches what most people need. The goal is to keep a file private while it is sent by email, stored in the cloud or left on a shared drive, not to stop the intended recipient from printing it.

How to add a password to a PDF

1. Open Protect PDF and drop your file onto the page, or select Choose PDF. You can add up to 12 PDFs to protect them with the same password.
2. If the file already has a password, enter it in the PDF password field and select Open PDF.
3. Type your new password in New password and repeat it in Confirm password.
4. Select Apply and download the encrypted PDF.
5. Open the downloaded file once to confirm the password works before you delete any unprotected copy.

Choosing a strong password

Because AES-256 itself is not the weak point, a short or predictable password is. Attackers who obtain an encrypted PDF can try billions of guesses offline, starting with common words, names, dates and leaked passwords. A good PDF password is:

• Long: at least 12 to 16 characters, or a passphrase of four or more unrelated words.
• Unique: never reused from an email account, bank or other service.
• Unpredictable: not a birthday, account number, company name or the document title.
• Stored safely: in a password manager, because nobody can recover a lost password for you.

If you need a random password, create one with the Random string generator, which uses your browser’s secure random number generator. Choose a length of 20 or more characters.

Sharing a protected PDF safely

Encryption only helps if the password does not travel with the file. Send the PDF by email and the password by text message, phone call or a different messaging app. For recurring exchanges, such as monthly payslips or statements, agree on a password in advance so it never needs to be sent with the documents. Remember that the recipient can save, forward or print an opened file, so encryption protects the file on its way, not after it is shared.

Do your edits before you encrypt

Most tools save their output without a password, even when the input was protected. If you also need to merge, sign, compress or add page numbers, do all of that first and make Protect PDF the final step. If a file is already digitally signed, adding encryption changes the file and may affect the signature, so the tool warns you when it detects one.

Removing a password you know

To create an unprotected copy, for example to archive a statement or to edit a file you received, open Unlock PDF, enter the current password and select Apply. The result is a decrypted copy of the document. Unlock PDF only works with the correct password: it does not guess, crack or bypass passwords, and no legitimate tool can recover a strong AES-256 password you have forgotten.

Frequently asked questions

Will the protected PDF open everywhere?

AES-256 is supported by current PDF readers, browsers and mobile apps. Very old PDF software may not support it. If a recipient cannot open the file, ask them to update their PDF reader.

Is the document metadata encrypted too?

The encryption covers the document’s content and strings. The file name is not part of the PDF, so avoid putting sensitive information in it.

Can I set a printing or editing restriction?

No. Protect PDF sets an open password only. Restrictions are easy to ignore with many PDF programs, so an open password is the meaningful protection.