Protecting a PDF encrypts it with AES so it cannot be opened without the password, and optionally restricts printing and copying for people who can open it. The encryption is real cryptography rather than a flag a reader chooses to honour: without the password, the content is not readable by any software. The permission restrictions are a weaker thing — they are instructions in the file that well-behaved readers obey and others ignore — so treat the open password as the control that matters and the permissions as a statement of intent. Both the file and the password are handled in your browser, which means the password you are about to rely on is never transmitted to anyone. Choose it accordingly, and send it to the recipient by some channel other than the email carrying the document.
Two kinds of password
A user password — sometimes called the open password — is required to decrypt and view the document. Without it there is nothing to read, and no reader can bypass it.
An owner password governs permissions: whether printing, copying text or editing is allowed for someone who has already opened the file. The distinction matters because the second is enforced by convention. Compliant readers honour it; plenty of tools do not. If content must not be extracted, do not distribute it rather than relying on a permissions flag.
The password is the whole security
AES encryption is not the weak point; the password is. A short or guessable one can be attacked offline at whatever speed the attacker's hardware allows, and there is no lockout to slow them down because the file is in their possession.
Use a long passphrase rather than a clever short password. And send it separately — a password in the same email as the attachment protects against nothing except accidental forwarding, which is a real risk but not the one encryption is for.
Before you encrypt
Do the other work first. An encrypted PDF cannot be merged, split, compressed or edited until it is decrypted again, so if the document still needs assembling, assemble it and encrypt the finished file.
Consider whether encryption is the right control at all. If the concern is a specific paragraph, redaction removes it and leaves a document anyone can open. If the concern is the whole document reaching the wrong person, encryption is exactly right — provided the recipient can be given the password by another route.