PaperKit

Protect PDF with a Password

Add a password so the PDF cannot be opened without it, and optionally restrict printing and copying. Both the file and your password stay on your device.

Drop PDF here

or click to browse

Private: files never leave your device

Protecting a PDF encrypts it with AES so it cannot be opened without the password, and optionally restricts printing and copying for people who can open it. The encryption is real cryptography rather than a flag a reader chooses to honour: without the password, the content is not readable by any software. The permission restrictions are a weaker thing — they are instructions in the file that well-behaved readers obey and others ignore — so treat the open password as the control that matters and the permissions as a statement of intent. Both the file and the password are handled in your browser, which means the password you are about to rely on is never transmitted to anyone. Choose it accordingly, and send it to the recipient by some channel other than the email carrying the document.

Two kinds of password

A user password — sometimes called the open password — is required to decrypt and view the document. Without it there is nothing to read, and no reader can bypass it.

An owner password governs permissions: whether printing, copying text or editing is allowed for someone who has already opened the file. The distinction matters because the second is enforced by convention. Compliant readers honour it; plenty of tools do not. If content must not be extracted, do not distribute it rather than relying on a permissions flag.

The password is the whole security

AES encryption is not the weak point; the password is. A short or guessable one can be attacked offline at whatever speed the attacker's hardware allows, and there is no lockout to slow them down because the file is in their possession.

Use a long passphrase rather than a clever short password. And send it separately — a password in the same email as the attachment protects against nothing except accidental forwarding, which is a real risk but not the one encryption is for.

Before you encrypt

Do the other work first. An encrypted PDF cannot be merged, split, compressed or edited until it is decrypted again, so if the document still needs assembling, assemble it and encrypt the finished file.

Consider whether encryption is the right control at all. If the concern is a specific paragraph, redaction removes it and leaves a document anyone can open. If the concern is the whole document reaching the wrong person, encryption is exactly right — provided the recipient can be given the password by another route.

Frequently asked questions

Are my PDF files uploaded to a server?

No — this tool runs entirely in your browser using WebAssembly and JavaScript. Your files never leave your device, which also means there are no size limits and no queues.

What encryption is used?

Files are encrypted with AES — the standard PDF encryption every modern reader (Adobe, Preview, browsers) can open given the correct password.

What if I forget the password?

There is no backdoor — without the password the file cannot be decrypted. Keep an unprotected copy somewhere safe.

What happens if I forget the password?

The document is unrecoverable. That is what encryption means — there is no backdoor here or anywhere else. Keep a copy of the password in a password manager, or keep the unencrypted original somewhere safe.

Do the printing and copying restrictions actually work?

Only with readers that choose to honour them; they are instructions in the file rather than cryptographic enforcement. The open password is the real control. Treat permissions as a statement of intent, not a guarantee.

More PDF tools

Advertisement