How to password protect a PDF file

What a PDF password actually does

A password on a PDF is not a label on the outside of the file. The content is encrypted, which means the text, images and page data are scrambled with a key derived from your password. Without the password, a PDF viewer cannot show the pages, and the raw file is unreadable.

Modern protection uses AES-256, a widely used encryption standard. The strength of the lock is therefore rarely the problem. The weak point is almost always the password itself, or the way it is shared.

Open password versus owner password

A PDF can carry two different passwords, and they do different jobs. The open password (also called the user password) is required to view the document at all. Anyone without it sees only a password prompt.

The owner password controls permissions. A file with only an owner password opens for everyone, but the author can flag actions such as printing, copying text or editing as not allowed. You can set both, one, or the other depending on what you want to achieve.

• Open password: use it when the content must stay private, such as contracts, payslips, medical records or ID scans.
• Owner password: use it when the file can be read by anyone but you want to discourage printing, copying or editing.
• Both: use different passwords so that people who can open the file cannot lift the restrictions.

How to protect a PDF step by step

The process is the same whichever tool you use. With our tool, everything runs in your browser and the file is not uploaded.

• Open the Protect PDF tool and choose your file. Files up to 200 MB and 2,000 pages are accepted.
• Type an open password if the file must be hidden from people who do not know it, and retype it to confirm.
• Optionally add an owner password and untick the permissions you want to restrict: printing, copying or editing and annotating.
• Run the tool and download the new PDF. Your original file is not changed, so keep it or delete it deliberately.
• Open the protected copy once in a normal PDF viewer and confirm the password prompt appears and the password works.

Choosing a password you will not regret

Length beats cleverness. A passphrase of four or five unrelated words, or a random string from a password manager, is far harder to guess than a short word with a number on the end. Avoid names, birthdates, phone numbers and anything visible on the document itself.

Do not reuse a password you use for email or banking. A PDF password is often shared with a third party, so treat it as disposable: one document, one password.

Write it down somewhere safe before you send the file. We cannot recover a lost password, and neither can anyone else without guessing it. If you forget it and have no unprotected copy, the document is gone.

What permission restrictions can and cannot do

Permissions are instructions stored in the file that well-behaved PDF software agrees to follow. Adobe Reader, browsers and most desktop viewers will grey out the Print or Copy commands. But the rules are only enforced by cooperating software. A program that ignores them, or a tool that removes owner restrictions, can bypass them.

So use permissions for reasonable friction, such as stopping accidental edits, not as security. If a document is truly confidential, an open password is the only setting that keeps the content unreadable to people who do not have it.

Sharing the password safely

Never put the password in the same email as the attachment. Send it through a different channel, such as a text message or a phone call, so that one intercepted message does not expose both.

If the recipient needs to work on the file later, they can remove the protection with Unlock PDF once they know the password. That tool only opens files you can already open: it does not guess or crack passwords.

Before you protect: check what the file reveals

Anyone who has the password can also read the document properties: author name, software used, creation and modification dates. If those details matter, clear them with Remove PDF Metadata first, then add the password to the cleaned copy. Doing it in this order means the protected file never carries the details in the first place.