Protect PDF with a password — AES-256, done on your device

How to use Protect PDF

1. Choose the PDF you want to protect.
2. Type a password in Password to open, then type it again in Repeat password.
3. Decide on the permission boxes: Allow printing and Allow copying text are on by default, and Allow editing is off.
4. Press Protect PDF.
5. Download the copy ending in -protected.pdf and open it once to check the password works.

What it does and when to use it

An open password (sometimes called a user password) means the PDF cannot be read at all without it. The file’s contents are encrypted, so even someone who copies the file cannot see the pages until the right password is entered.

That is useful whenever a document travels through places you do not control: payslips and salary letters sent by email, a scanned passport or ID shared with an agent, a medical report sent to a relative, contracts and invoices stored in shared folders, or a CV containing your home address and phone number. Banks and employers often send statements this way for the same reason.

Because the work happens in your browser, this is also a private way to do it. You never hand an unencrypted copy of the document, or the password, to a website’s server.

How it works

The tool opens your PDF with pdf-lib and applies the standard PDF encryption defined in ISO 32000-2 (PDF 2.0), using AES with a 256-bit key. That is the strongest encryption the PDF format offers.

Your password becomes the open password. The tool also sets an owner password, which PDF readers use to decide whether a user can change permissions. It generates a random 32-character owner password for you and does not show it, so the permission settings you choose cannot be changed with a password someone might guess.

The permission boxes set flags inside the file:

Filling in form fields and accessibility features (such as screen readers) are always allowed. A short note in the result reminds you that these flags depend on the reader respecting them.

Worked examples

Emailing a payslip to a landlord. Choose a password of 12 or more characters, untick nothing, and send the -protected.pdf by email. Text the password separately. The landlord’s phone opens the file after they type it.

Sharing a contract you do not want edited. Leave Allow editing off and keep printing on. Readers that respect permissions will not allow changes. Remember this is a request, not a lock, so keep your own unprotected original for comparison.

A quick password like “1234”. The tool still encrypts the file, but it warns you that short passwords can be guessed by offline cracking tools. Twelve or more characters, or several unrelated words, make guessing impractical. The Passphrase Generator can suggest one.

Limits and tips

• The password can be up to 127 characters. Longer is stronger; a few random words are easy to type and hard to guess.
• If your PDF already has an open password, remove it first with PDF Unlock, then protect it with the new one.
• Protecting a file does not shrink it. If it is too large to send, compress it first with the PDF Compressor or Compress PDF to 1 MB, then add the password.
• Encryption hides the content but not the fact that the file exists or its file name. Rename the file if the name itself is sensitive.
• To hide only part of a page, such as an account number, use the PDF Redaction Tool instead, which removes the content permanently.