Protect PDF

What this PDF protection tool does

Drop a PDF, type a password, download a copy that cannot be opened without it. Optionally untick what readers may do with the document once it is open: printing, copying text and images, editing, or commenting and form filling. You can also leave the open password empty and only restrict permissions — the file then opens freely but readers refuse to print or copy from it, the arrangement used for distributed forms and reports. Encryption is AES-256, the strongest the PDF standard defines (PDF 2.0, revision 6), applied by QPDF compiled to WebAssembly.

Because the whole operation runs inside your browser, the document and the password you type are never transmitted — an important difference from upload-based sites, where the very thing you want to keep secret has just been sent to a server together with its key. Everything else in the file — pages, text, images, forms, bookmarks — is preserved exactly. The result is a standard encrypted PDF that opens in Acrobat, Preview, Chrome, Edge, phones and every other reader that supports AES-256, which is all of them released in the last decade.

How to use it

Drop or choose the PDF. Enter the password twice (tick Show password to see it), untick any permission you want to withhold, and press Protect PDF. Download yourfile-protected.pdf and send it; give the password to the recipient by another channel — a message, a call — never in the same email as the file. The summary line under the options tells you what will be applied; the button stays disabled until the two passwords match and something is actually being set.

The owner password under Advanced is what a recipient would need to change the permissions later; if you leave it empty a random one is generated, so the restrictions cannot be lifted by simply entering the open password. Set it yourself only if you want to be able to unlock the file later without using this site's Unlock PDF — which, with the open password, removes both layers anyway. Prepare the document first: merge, organize, sign and compress all require an unencrypted file.

Common pitfalls

There is no recovery. AES-256 with a forgotten password means the document is gone for good; keep the unprotected original somewhere safe and store the password in a password manager. A weak password is the only practical weakness — eight characters is a minimum, a passphrase of several words is better. Permission restrictions are a different matter: they are honored by well-behaved readers but not enforced by cryptography, and anyone with the open password can strip them with a tool like this one. Use them to signal intent, not to prevent a determined person.

Protection does not hide metadata: the title, author and page count remain readable by tools that look, and file names are of course visible. Some older readers, and a few web viewers, cannot open AES-256 files; if a recipient reports an error, ask them to use a current browser or Acrobat Reader. Already-encrypted input is refused — remove the old password with Unlock PDF first, then protect with the new one.

Background: what the encryption does

The PDF standard defines two passwords. The user password is required to open the document; the owner password grants full rights, including changing the permissions. Both are turned, through a slow hash with a random salt, into a 256-bit key that encrypts every string and stream in the file with AES in CBC mode. Without the password the content is indistinguishable from random bytes — which is why forgetting it is final. Permission flags are stored alongside, encrypted too, and readers check them before offering print or copy commands.

QPDF, the engine used here, is the reference tool many desktop and server products rely on; it runs unchanged in WebAssembly inside a worker thread, so the page stays responsive while a large file is encrypted. The 1.3 MB engine is downloaded once on first use and cached; after that the page works offline. Nothing about the file, the password or the result ever leaves your device.

When you need to protect a PDF

Sending a contract, offer letter or medical report by email. Sharing payslips, tax returns or bank statements with an accountant or a landlord. Distributing a price list or a course handout that should be viewable but not editable or copied wholesale. Locking a scanned ID or passport you have to send to a service. Handing over a manuscript or design proposal to a reviewer. Archiving personal documents on a shared drive or cloud folder.

On this site the natural order is: assemble the document with merge and organize, sign or watermark it, compress it, and protect it here as the very last step — every other tool needs the unencrypted file.

Frequently asked questions