Protect PDF
Protect PDF encrypts your document so it cannot be opened without the password you choose. You can also set an owner password and turn off printing, copying, editing and annotation. Encryption happens in your browser - the password is never sent anywhere.
1 Add your file
Enter the open password to use it here. It is checked in your browser and never sent anywhere.
2 Choose your options
The open password is real AES-128 encryption: without it the file cannot be read at all, by us or anyone else. The permission flags are different in kind. They are instructions to the reader application, and a well-behaved reader obeys them while software that chooses not to can ignore them. Use the open password when the content must stay private, and treat the permissions as a clear statement of intent rather than a lock.
How to protect PDF
Add your PDF
The document is read into this tab and never sent anywhere — which is rather the point for a file you are about to encrypt.
Set the password and permissions
Choose a strong open password, and decide what a reader is allowed to do with the document.
Download the protected PDF
Encrypted with AES-128 in your browser. Write the password down first.
Encryption, and the password that actually matters
A PDF can carry two different passwords. A user password encrypts the document so it cannot be opened at all without it. An owner password only sets permission flags — no printing, no copying — which readers choose to honour, while the content itself stays decryptable without that password.
So if you need real protection, it is the user password that provides it. This tool encrypts with AES-128, which is a modern, well-analysed cipher and is supported essentially everywhere — the practical balance between genuine strength and opening reliably on whatever the recipient happens to have.
A worked example
A payroll summary is sent to an accountant with a user password of four unrelated words. That is far stronger than a short password with symbol substitutions and much easier to read out over the phone — which matters, because the password should travel by a different route than the file. A protected PDF and its password in the same email thread offers very little.
Limitations worth knowing
- Nobody attacks the cipher; they guess the password. Length beats complexity — several unrelated words outperform a short password with symbols.
- A forgotten user password cannot be recovered. There is no master key and no back door.
- Permission flags are honoured by convention only, and can be removed from a file by anyone holding it.
- Anything a reader can display can be captured. A no-copy flag does not survive a screenshot and OCR.
- AES-128 is widely supported; stronger variants defined in later revisions may not open in older readers and some mobile apps.
Further reading
PDF Passwords Explained: Open Passwords, Permissions and Real Encryption
Related tools
Protect PDF — frequently asked questions
AES-128 using the PDF standard security handler, which is genuinely strong — a good password cannot be brute-forced. The weak link is the password itself, not the cipher, so pick something long rather than something clever.
The open password is needed to view the document at all. The owner password governs the permissions: someone with it can change them. If you set only an open password, it is used for both.
Compliant readers honour them, and that covers most people most of the time. Software that ignores the flags exists, and once someone can read a document they can photograph the screen. The permissions express intent clearly; only the open password actually controls access.
No — and there is no server to send it to. Key derivation and encryption happen in JavaScript in this tab. You can disconnect from the network before pressing the button and the tool still works.
No. That is not modesty, it is arithmetic: AES-128 with a decent password cannot be broken, and we never had a copy. This is also why we will not build a password cracker.
Yes. AES-128 with revision 4 is understood by Acrobat, Preview, Chrome, Edge, Firefox and every mainstream mobile reader.