Password protect PDF
Add a password and choose what others may do with the file.
or drop files anywhere on this page
Your files stay in this browser. Nothing is uploaded.
About Protect
To password protect a PDF here, set an open password, an admin password, or both, and the file is encrypted in your browser tab using the standard PDF security handler. A reader must type the open password before the file will open, and a reader that honours permissions will hold to the ticks you leave off for printing, copying and editing.
Reach for it before sending something sensitive by email or a shared drive, when you trust the recipient with the content but not the channel. It does not touch the pages themselves, and permission restrictions are only as strong as the reader that opens the file. The password is what protects the content.
How it works
- Add one or more PDFs. If a file already needs an open password, type it in the password field on its file chip; the Encrypt PDF button stays unavailable until the chip shows "Password OK".
- Type a Password that must be entered to open the file, an Admin password to change permissions, or both. At least one is required, and spaces at the start or end are dropped.
- Choose an Encryption method. Strong (AES 256 bits) is selected by default; Medium (AES 128 bits) and Medium (RC4 128 bits) are for older readers.
- Under Allowed PDF reader permissions, untick whatever readers should not be allowed to do. All seven start ticked: Modifying, Copying text and graphics, Printing, High resolution printing, Filling forms, Commenting, and Insert, rotate, or delete pages.
- Click Encrypt PDF and download the result. One file comes back as a PDF under its original name; several come back together in a ZIP.
What the password and the admin password each do
The Password field sets the open password. Without it, a reader shows a password prompt and nothing else. The Admin password to change permissions field sets what the PDF standard calls the owner password. It does not stop anyone opening the file; it stands behind the permission checkboxes, so that whoever holds it can lift the restrictions.
Set only an admin password and the file opens for everyone, with the actions you unticked marked as not allowed. Set only a Password and the tool uses that same value as the admin password too, so in a reader that checks it as the admin password, the person who typed it is not bound by the checkboxes. If the restrictions should apply to people you give the open password to, set a different admin password.
- Unticking Printing means no printing at all. With Printing ticked, unticking High resolution printing allows low resolution printing only.
- Access for screen readers is always left allowed. There is no checkbox for it.
- The permission flags are stored in the file and each reader decides whether to obey them. The Unlock tool on this site removes them from any file that opens without a password, and other software can do the same.
Choosing an encryption method
Strong (AES 256 bits) is the default, and the one to use unless you know the recipient's reader cannot open it. The two Medium methods exist for older readers. The encryption library this tool uses refuses RC4 unless told otherwise, describing it as broken, and the tool switches that override on only when you choose RC4.
The method matters less than the password: a guessable one gets in whichever method you pick, which is why the page suggests 16 or more characters.
- With the two Medium methods, only the first 32 characters of a password count, and characters outside the Latin-1 range, such as Cyrillic, Chinese, Arabic or emoji, are refused with "Password contains one or more invalid characters."
- With Strong (AES 256 bits) the password is read as UTF-8 and the first 127 bytes count.
- A file that declares itself PDF/A cannot be encrypted, because that archival format forbids it. The tool stops with an error and produces no file.
A worked example
You have a 12-page contract to send to a client by email. Add the file, type a long passphrase into Password, and type a different value into Admin password to change permissions. Leave Encryption on Strong (AES 256 bits), untick Modifying and Copying text and graphics, leave Printing ticked, and click Encrypt PDF.
The download has the same file name as the original and asks for the passphrase on opening. Send the passphrase by a different route than the file, such as a phone call or a messaging app, because anyone who sees both in one inbox has everything they need.
Protecting a file that is already protected
A file that already needs an open password must have its current password typed on its file chip first. The copy you download carries only the new passwords, and the old one stops working on it. To take a password off again, use Unlock, which needs the password.
Frequently asked questions
The password is required to open the document at all. The admin password, which the PDF standard calls the owner password, does not stop anyone opening the file. It stands behind the restrictions on printing, copying and editing, so that whoever holds it can change them.
Only by PDF readers that choose to obey them. The flags are stored inside the file and nothing forces a reader to respect them, so treat them as a deterrent, not a hard barrier. Removing them from a file that opens without a password takes one run of the Unlock tool.
Strong (AES 256 bits), which is selected by default and is the strongest of the three offered. The Medium (AES 128 bits) and Medium (RC4 128 bits) options exist for older readers that cannot handle AES 256, and RC4 is the one the encryption library itself calls broken.
There is no way to recover it from the file. The document is encrypted with that password, and this tool cannot remove one it does not already know. Save it in a password manager at the time you set it, before you close the file. The two password fields do keep their last value in this browser, as every option on the site does, so clear them on a machine you share.
Yes. Add multiple PDFs and each is encrypted with the same settings, then returned together in a ZIP.
No. Set only the password if you want to require it to open the file, only the admin password if anyone should be able to open it but not print or edit it, or both for a document that needs both layers. If you set only a Password, the same value is used as the admin password.
No. The pages, text and images are not altered. Encryption adds a security section and the permission flags, and once the file is opened with its password the document reads as it did before.
No. The file is read, encrypted and saved by code running in your browser tab, and neither it nor the passwords are sent to a server. The page itself needs the network to load.
Because the two Medium methods only accept characters up to the Latin-1 range, which covers most Western European letters but not Cyrillic, Chinese, Arabic or emoji. Choose Strong (AES 256 bits), which reads the password as UTF-8.
If their PDF reader supports the method you chose. If a recipient cannot open a Strong (AES 256 bits) file, encrypt the original again with a Medium method and send the new copy.
Related tools
This tool ran entirely in your browser and nothing was uploaded. Your Recent files list keeps a copy of local files under 5 MB until you clear it. How your files are handled.