How to password protect a PDF for free

Password protection on a PDF means the file is encrypted, and a reader must supply the password to decrypt and display it. Modern PDFs use AES-256, the same cipher standard used for disk encryption. It's genuinely strong — the weak point is almost always the password, not the algorithm.

The awkward gap in most online tools

Most services that add a password work like this: you upload the unprotected file, their server encrypts it, and you download the result.

Look at what that means. For the duration, your unencrypted sensitive document and the password you chose both exist on infrastructure you don't control. The whole point of the exercise was to keep that document private.

Browsers have shipped the Web Crypto API for over a decade, so AES-256 runs perfectly well on your own machine. There's no technical reason for the upload.

Doing it in your browser

1. Open Protect PDF and choose your file
2. Type a password twice — the strength meter shows how well it would resist guessing
3. Decide whether people who have the password may print or copy text
4. Download the encrypted copy

The password is never transmitted. Which also means nobody can recover it for you — not us, not anyone. Write it down before closing the tab.

Choosing a password

AES-256 is not going to be broken. Password1! will be, in seconds.

Offline cracking tools work through predictable patterns first: a dictionary word, capitalised, a digit, a punctuation mark on the end. That's the shape most people reach for, and it's the first thing tried.

Better habits:

• Four unrelated words beat one clever word. copper-harbour-quilt-nine is dramatically stronger than Tr0ub4dor&3 and much easier to read out over the phone.
• Never reuse an account password. If that service is breached, your document is too.
• Send the password by a different channel. Emailing the file and the password together protects nothing at all. Send the file by email, the password by message.
• Store it in a password manager before you close the tab. There is no reset link.

User password vs owner password

Two different things, often confused:

A user password is required to open the document at all. Without it, you see nothing.

An owner password doesn't restrict opening — anyone can read the file — but limits actions like printing or copying text.

For most purposes you want a user password, and the tool here sets both to the same value so the document simply can't be opened without it.

Worth knowing: owner-password restrictions are honoured as a courtesy by well-behaved readers, not enforced cryptographically. Some tools ignore them entirely. Treat print and copy limits as a convenience, not a security boundary.

What it does and doesn't prevent

It does: stop anyone opening the file without the password. If it's intercepted in email or left on a shared drive, the contents stay unreadable.

It doesn't: stop someone who has the password from screenshotting pages, retyping the contents, or forwarding the file. Once decrypted, it's an ordinary document.

Password protection is a strong lock on a container. It isn't rights management, and treating it as such leads to unpleasant surprises.

Removing it later

If you have the password and want to take protection off — say, before merging the file with others — use Unlock PDF. Same principle: the work happens on your device, and the password never leaves it.