Upload the PDF
Drop in the document you want to protect. There is nothing to install, no account, and no charge. The file is used only to produce the encrypted copy.
Protect PDFs With A Simple Password Flow
Add password protection without opening a heavy editor, then export one secured PDF for controlled sharing.
Step 1
Load one PDF and set access passwords
Step 2
Plan who can open the file and who can control it
Password to open the PDF
Share this with anyone who should be able to open the file.
Password to control the PDF
Keep this private. It controls permissions and admin-level ownership.
Protection summaryThe exported PDF will use AES-256 encryption. People need the user password to open it, while the owner password remains your private control key.
Step 3
Create the protected PDF
Check both passwords once before exporting. Losing the owner password can make future changes difficult.
Upload a PDF first to unlock export.
Three steps, under a minute
How to password protect a PDF
Protecting a PDF comes down to one decision: the password someone needs in order to open it. Everything else is optional.
Set the open password
The user password is the one that matters — it is what a reader must type before the document appears. The owner password is separate and optional: it marks who keeps administrative control of the file's security settings. Leave it blank and the user password is used for both, which means anyone who can open the file also controls it.
Export and share the password separately
The exported PDF is encrypted with AES-256 and prompts for the password in any current viewer. Send the file and the password through different channels — an encrypted attachment and its password in the same email protects nothing.
Worth knowing before you rely on it
What a PDF password actually protects — and what it does not
PDF has two different things people both call “password protection”, and only one of them is real security. An open password encrypts the contents, so without it there is nothing to read. Permission restrictions — no printing, no copying — are flags recorded inside a file that has already been decrypted by the time a viewer reads them, which means any tool that chooses to ignore them can. This page applies an open password and does not apply permission flags, because the second kind offers the feeling of protection rather than protection.
Stops anyone without the password reading the file
Yes — this is real. The contents are encrypted with AES-256. Without the password there is nothing to read, in any viewer, on any device.
Protects the file if someone gets a copy of it
Yes — this is the point. An encrypted PDF is safe at rest. A forwarded email, a lost laptop, or a misaddressed message exposes a file nobody can open.
Stops the recipient printing or copying the text
No — do not rely on this. Permission flags are advisory. The file is decrypted before a viewer reads them, so any tool can ignore them, and many do. This page applies an open password rather than permission flags for exactly that reason.
Stops the recipient forwarding the document
No. Anyone who can open the file can pass on both the file and the password. Encryption controls who can read it, not what a reader then does.
Survives a weak password
No. The cipher is never the weak point — the password is. AES-256 protecting a dictionary word is guessed, not broken.
Can be recovered if you forget the password
No — by design. There is no back door and no reset. That is the same property that makes the protection worth having in the first place.
Current practice
PDF encryption in 2026, and how it got here
PDF encryption has been rewritten several times, and a lot of software still emits the old schemes. Knowing which one you are getting matters, because two files that both say “password protected” can be decades apart in how much protection that means.
- 40-bit RC4 — obsolete. The original scheme. Removable in seconds with ordinary hardware; treat a file using it as unprotected.
- 128-bit RC4 — obsolete. Better, but RC4 itself is no longer considered sound and this scheme is deprecated.
- AES-128 — still respectable. A real cipher, and fine for most documents, but superseded.
- AES-256 — the current standard, and what this tool writes. Introduced with PDF 2.0 using modern key derivation. Supported by every current viewer.
Two habits matter more than the cipher choice. Use a passphrase of several unrelated words rather than a single word — the password, not the encryption, is what an attacker goes after. And never derive it from the document itself: the client name, invoice number, or date are the first guesses anyone makes.
PDF password protection, answered
Upload the PDF, set the user password — the one someone needs to type to open the file — and export. That single step is the protection: the exported PDF is encrypted, and without the password its contents cannot be read by any viewer. The owner password is a second, separate password you keep to yourself; it is optional, and if you leave it blank the user password is used for both.
It depends entirely on which of the two protections you mean. An open password is real cryptography: the file contents are encrypted with AES-256, and nobody reads them without the password or an infeasible amount of computing time. Permission restrictions — the flags that say "no printing" or "no copying" — are not. They are a request recorded in the file, and the file is fully decrypted before a viewer ever reads them, so any tool that chooses to ignore them can. Adobe Reader honours them; plenty of other software does not, by design rather than by malice. So: use an open password to keep a document private, and do not rely on permission flags to stop someone determined from printing or copying a file they can already open.
AES-256, written using revision 6 of the PDF security handler — the current standard, introduced with PDF 2.0. It is worth knowing what it replaced, because plenty of tools still emit the older schemes: PDF originally shipped 40-bit RC4, which is broken and can be stripped in seconds; 128-bit RC4 followed and is also considered obsolete; AES-128 came next and is still respectable; AES-256 with the modern key derivation is what you want today. Files encrypted here open normally in Acrobat, Preview, Edge, Chrome, and any other current viewer.
The user password is the open password — it is required to view the document at all, and it is what actually protects the contents. The owner password is the permissions password: it does not gate opening the file, it marks who holds administrative control and can change the security settings later. They must be different values to be meaningful. If you set only a user password, that same password is used as the owner password, which means anyone who can open the file also holds full control of it.
No, and it would be dishonest to imply otherwise. This tool applies an open password rather than permission restrictions, so once someone has the password and the file is open, they can print it, copy text out of it, and edit it. That is a deliberate choice: permission flags are advisory, widely ignored, and trivially removed, so shipping them would give you a feeling of protection rather than protection. If a document genuinely must not be copied, the control that works is not sending it to people you do not trust.
The encryption is only ever as strong as the password in front of it — AES-256 protecting the word "invoice" protects nothing, because an attacker guesses the password rather than attacking the cipher. Use a passphrase of four or more unrelated words, or at least twelve mixed characters. Avoid anything derived from the document itself: the client name, the invoice number, the date, or the company name are the first things anyone tries.
Not in the same email as the PDF. An encrypted attachment and its password in one message is the digital equivalent of taping the key to the door — anyone who intercepts the message, or is forwarded it later, has both halves. Send the file by email and the password by a different channel: a text message, a phone call, or a messaging app. For a document you send regularly to the same person, agree a password once in person and reuse the channel, not the message.
No. This tool adds protection and does not remove it, and there is no recovery route: AES-256 with a decent password is not something that can be brute-forced within a useful timeframe, which is exactly the property that makes the protection worth having. If you no longer have the password, the practical options are to find the original unencrypted file, or to ask whoever created the document to send a fresh copy. Be sceptical of services that claim to unlock any PDF instantly — against a modern AES-256 file with a strong password, that claim cannot be true.
Not through this tool. The reliable approach is to keep your original unprotected file, and re-export a newly protected copy whenever the password needs to change, rather than trying to modify the protected one. Treat the encrypted PDF as a sealed copy for sending, not as your working document.
Yes. AES-256 is supported by every current PDF viewer, so the file opens in Acrobat and Preview, in the built-in viewers in Chrome, Edge, Safari, and Firefox, and on iPhone and Android. Each will prompt for the password before showing anything. Very old software — roughly pre-2017 viewers that never implemented PDF 2.0 encryption — may refuse the file, which is a compatibility limit rather than a fault in the document.
No. The pages, text, images, fonts, and layout are untouched, and nothing is stamped onto the document. The only change is that the file is encrypted, so it asks for a password before it displays.
Your file is uploaded over an encrypted connection, used only to produce the protected version, and removed after your session ends. It is not stored long-term, sold, or shared. Encryption is applied on our server rather than inside your browser, so the document does leave your device — if that is unacceptable for a particular file, encrypt it with local software instead. The passwords you type are used to produce the file and are not retained.