Password protect a PDF with AES-256 encryption
The Protect PDF tool adds a password to a PDF so that nobody can open it without that password. It encrypts the whole document — text, images, attachments and form data — with AES-256, the strongest encryption the PDF standard defines, using the open-source qpdf engine compiled to WebAssembly.
It is made for the documents people email every day: salary slips, bank statements, tax returns, medical reports, contracts, ID scans and invoices. Share the password over a different channel — a phone call or a text message — and the file is useless to anyone who intercepts the email.
Encryption happens inside your browser. The PDF and your passwords are never uploaded, never logged and never stored, and the tool checks the finished file before you download it: it must refuse to open without the password and open correctly with it.
How to password protect a PDF
- Drop your PDF onto the upload area or click it to choose the file.
- Type an open password and type it again in Confirm open password. The strength bar gives a rough guide.
- Optional: tick Restrict printing, copying and editing, choose what readers may do and set an owner password.
- Press Protect PDF. The encrypted copy is verified and downloaded as yourfile-protected.pdf.
- Open it once in your usual PDF reader to confirm the password works before sending it.
Protect PDF features
AES-256 encryption
Files are encrypted with AES-256 using the revision 6 security handler from PDF 2.0 (ISO 32000-2), supported by Adobe Acrobat Reader X and later, Chrome, Edge, Firefox and macOS Preview.
Open and owner passwords
The open (user) password is needed to view the file; the optional owner password controls permissions. Leave the owner password empty and a random one is used.
Permission controls
Allow or block high-quality printing, low-resolution printing, copying, editing, form filling, comments and page changes.
Built-in verification
Before the download starts, the encrypted file is reopened with a separate PDF engine to prove it is locked and that your password unlocks it.
Strength meter and confirmation
A typing check catches mismatched passwords, and the meter warns about short or common passwords such as “password123”.
Private by design
No upload, no account and no password storage. Close the tab and nothing remains.
Open password vs owner password
| Open (user) password | Owner (permissions) password | |
|---|---|---|
| What it does | Required to open and read the PDF | Required to change permissions or security settings |
| Protects the content? | Yes — the content is encrypted with a key derived from it | No — it only governs what a reader allows after opening |
| Who needs it | Everyone who should read the document | Only you, the author |
| If you forget it | The file cannot be opened; keep an unprotected original | Restrictions stay; readers can still open the file |
What PDF permissions can and cannot do
PDF permissions (printing, copying, editing and so on) are stored as flags inside the encrypted file. Acrobat Reader, browser viewers and most apps respect them, greying out the print or copy commands. They are a policy, not a lock: once a file is opened with the open password the content is decrypted, and software that chooses to ignore the flags can print or copy it. Use permissions to discourage casual reuse, and the open password to keep the document confidential.
One rule from the PDF specification is worth knowing: allowing comments and annotations also allows filling in form fields, so the tool ticks form filling automatically when you allow comments.
Choosing a strong PDF password
AES-256 itself is not the weak point — the password is. Revision 6 protects the random file key with a key derived from your password through at least 64 rounds mixing SHA-256, SHA-384, SHA-512 and AES (Algorithm 2.B of ISO 32000-2), but an attacker with the file can still try huge numbers of guesses offline. Short, common or personal passwords (a name plus birth year, “Welcome@123”) fall quickly.
Aim for 12 or more characters. A passphrase of four or five unrelated words is long and easy to read out over the phone. The Password Generator can create one for you.
- Send the password separately from the file — never in the same email.
- Keep an unprotected original in a safe place; a forgotten password cannot be reset.
- Before protecting a document, strip hidden details with Remove PDF Metadata and black out anything the recipient should not see with Redact PDF.
Protect PDF FAQ
How do I password protect a PDF for free?
Open the PDF in Protect PDF, type an open password twice and press “Protect PDF”. The encrypted copy downloads straight away. There is no sign-up, watermark or limit.
Is AES-256 PDF encryption secure?
Yes. AES-256 is the strongest encryption in the PDF standard and has no practical known attack. The security of your file depends on the password, so use a long, uncommon one.
Will the protected PDF open on phones and other computers?
Yes. AES-256 (revision 6) is supported by Adobe Acrobat Reader X and later, Chrome, Edge, Firefox, macOS and iOS Preview and current Android PDF viewers. Very old readers from before 2010 may not open it.
Can people still print or copy my protected PDF?
Only if you allow it. Tick “Restrict printing, copying and editing” to block them. Compliant readers obey these permissions, but they are flags rather than encryption, so they cannot stop determined software once the file is open.
Are my file and password uploaded?
No. The qpdf encryption engine runs as WebAssembly inside your browser. The PDF and passwords never leave your device and are not saved.
What if my PDF already has a password?
Remove the existing open password first with Unlock PDF (you need to know it), then protect the unlocked copy with your new password.
Can I remove the password later?
Yes. Open the file with Unlock PDF, type the password and download an unprotected copy.