What is the Protect PDF tool?
This tool encrypts a PDF so that it cannot be opened without the password you choose, and writes a set of permission flags that tell readers what may be done with it afterwards. You can password protect PDF online free here with AES-256 — the same algorithm strength used for full-disk encryption — and nobody has to hand their document to a website to do it.
Two different passwords are involved, and the distinction matters. The open password (the user password) is the one a recipient types to see the file at all; without it the pages are genuinely unreadable, not merely hidden. The owner password controls the permissions. If you leave the owner field blank it is set to the same value as the open password, which means anyone who can open the document also holds the keys to its restrictions — set a separate owner password when you want the permissions to stick.
The encryption itself is done by qpdf, a well-established PDF tool compiled to WebAssembly and run inside your browser. Your file is written into a virtual filesystem in the tab, encrypted there, and handed back to your browser as a download. The document, the password you typed and the generated key never travel over the network, which is why the warning next to the button is not a formality: nobody, including us, can recover a lost password.
How to add a password to a PDF
- Drop the PDF onto the upload area, or click it to browse for the file you want to lock.
- Type the password to open the document, then repeat it in the confirmation field — the meter shows how strong it is, and Generate strong password produces a random 20-character one you can copy.
- Pick a Permission preset — Full access, Fill & print, Print only or View only — as a starting point.
- Fine-tune the individual checkboxes under “What recipients may do”, watching the badge strip on the right update as you go.
- Open Advanced options if you need a separate owner password, or if the title and author should stay readable to search indexers.
- Press Encrypt & Download and save the protected copy — then store the password somewhere you trust.
Key features
- AES-256, revision 6 only — the weak RC4 40-bit and 128-bit options are deliberately disabled, because their keys can be recovered with ordinary tools.
- Eight separate permissions — printing, high-resolution printing, copying text, editing, annotating, form filling, accessibility extraction and page assembly, each on its own switch.
- Four presets — jump straight to a read-only file, a print-only file or a fill-and-print form without ticking eight boxes by hand.
- Password strength meter — an entropy estimate in bits, with a warning prompt if you try to encrypt with something guessable.
- Built-in password generator — 20 random characters from your browser's cryptographic random source, with a one-click Copy button.
- Recipient preview — see the blurred “Password required” view a reader will meet before the password is entered, and switch to the unlocked view to check the right document is loaded.
- Metadata control — encrypt the document information too, or leave it in clear text when an indexing system needs the title and author.
Benefits of securing your PDF here
- The plaintext never leaves your machine. Uploading an unencrypted payslip to a website in order to protect it defeats the purpose; here there is nothing to upload.
- Real encryption, not a viewer trick. The output is a standard encrypted PDF that Acrobat, Preview, Chrome and mobile readers all prompt for.
- Granular control in one screen. The badge strip always shows exactly which of the eight actions will be blocked, so you never guess what a preset did.
- Free with no ceiling. Protect as many documents as you like, at any size your device can hold, with no watermark and no signup.
- Honest about limits. The tool tells you plainly that permissions depend on the reader honouring them, and that a lost password means a lost file.
Who should use this tool?
Accountants and bookkeepers
Statements, tax computations and management accounts go out by email every month. Encrypt each one with a password the client already knows, allow printing but block copying so figures cannot be lifted into a spreadsheet, and keep the unencrypted original in your own system.
HR and payroll
Payslips and contracts are the classic case for a locked PDF. Use the Fill & print preset for documents an employee must complete and return, and set an owner password that differs from the open password so the restrictions cannot be lifted by the recipient.
Lawyers and other professional advisers
Draft agreements and advice notes are often shared before they are final. View only plus encrypted metadata keeps a draft from being printed, copied or re-titled, and because nothing is uploaded, privilege is not compromised by a third-party service holding a copy.
Anyone sending ID or medical documents
A scan of a passport or a test result travelling through email deserves a password, sent by a different channel — a message, not the same email. Generate a random one here, paste it into your password manager, and share it separately.
Frequently asked questions
How strong is the encryption used to lock the PDF?
AES-256 with the modern revision 6 handler, which is the strongest scheme the PDF specification defines. With a long random password there is no practical way to brute-force it; with a short dictionary word there is, which is what the strength meter is warning you about.
What is the difference between the open password and the owner password?
The open (user) password is required to view the document. The owner password only unlocks the permissions — changing what may be printed or copied. Leave the owner field empty and it copies the open password, so use a different value if the restrictions should survive sharing.
Will the permission settings really stop someone printing or copying?
They stop conforming readers. Acrobat, Preview and the major browsers honour the flags, so Print or Copy will be greyed out. The flags are part of the file rather than a physical barrier, though: someone with the owner password, or with software that simply ignores permissions, can override them. Treat permissions as a clear instruction, and the open password as the real lock.
Can you recover my password if I lose it?
No, and neither can anyone else. The file is encrypted on your device with the password you typed and we never see either of them. Write it down or store it in a password manager before you press Encrypt.
Is my document uploaded to secure it?
No. The qpdf engine is compiled to WebAssembly and downloaded once from a CDN, then the encryption runs entirely in your tab. The PDF itself is never transmitted, and the protected copy is saved locally by your browser.
Why are the RC4 40-bit and 128-bit options disabled?
Because they are broken. RC4-encrypted PDFs can be opened by off-the-shelf recovery tools in minutes, and PDF 2.0 deprecates them. Allowing them would let you produce a file that looks locked but is not, so only AES-256 is written.
Can I protect a PDF that already has a password?
Not directly — the tool cannot read it. Remove the existing password with the Unlock PDF tool, then encrypt the result here with your new password and permissions.
Can I remove the password later?
Yes, as long as you know it. Load the protected file into the Unlock PDF tool, enter the password and it writes a decrypted copy. Keep an unencrypted master somewhere safe as well, so a forgotten password is an inconvenience rather than a disaster.
Related tools you might need
Sending something confidential? Drop it in above and password protect PDF online free with AES-256 — then share the password separately.
Protect my PDF now