Protect a PDF with a password

Why put a password on a PDF

A payslip, a tax return, a medical report or a contract often has to travel by e-mail, sit in a shared folder or go onto a USB stick, and anyone who gets hold of the file can read it. A password on the PDF itself keeps it closed wherever the file ends up: the content is encrypted, and a PDF reader only shows it after the password is typed. This tool uses AES with a 256-bit key, the strongest method in the PDF standard, which current versions of Adobe Acrobat Reader, Apple Preview, Chrome, Edge and Firefox all open. The work is done by qpdf, a widely used open-source PDF program, running as WebAssembly in this page, so the file and the password stay on your device. You can also decide what someone who opens the PDF may do with it: print it, copy text and images out of it, or change it. Send the password by another route than the file, for example by text message or phone when the PDF goes by e-mail, or the lock protects very little.

How to password-protect a PDF

1. Drop your PDF in the box, or click to choose it.
2. Type a password twice, and untick anything people should not be allowed to do, such as printing.
3. Click Protect PDF and download the encrypted copy; your original file is not changed.

What changes when you convert

A forgotten password cannot be recovered

The password is not stored anywhere, not in the file and not on this site, and the content can only be decrypted with it. If it is lost, nobody can open the protected copy, including this tool. Keep your unprotected original, or write the password down in a safe place such as a password manager.

The strength is in the password

AES-256 cannot be broken by trying keys, but a short or common password can be found by trying passwords, and a copy of the file can be attacked at leisure on someone else's computer. Use a long passphrase of several unrelated words, or at least 12 characters with no name, date or dictionary word in it.

Restrictions are a request, not a lock

The password to open the PDF really encrypts the content. Blocking printing, copying or changes works differently: the file only tells the reader what the author allows, and Acrobat, Preview and the browsers obey it, but some programs simply ignore it. Use the restrictions to discourage casual copying, and never to keep something secret from people who can open the file.

The permissions password

When something is blocked, a second password, the permissions password, is the only way to lift the block later. Set one if you might want to, and make it different from the password that opens the file. If you leave it empty, a random one is used and thrown away, and the restrictions stay in that copy for good.

Digital signatures and old readers

Encrypting rewrites the whole file, so a digital signature in it is no longer valid; protect the PDF before it is signed, not after. AES-256 has been part of PDF readers for well over a decade, but very old programs or some simple viewers built into printers and e-readers may not open the file at all.