Sending private papers? Lock the PDF first

The short answer

If a private PDF will travel by email or chat, or sit on a phone, USB drive or cloud folder that others might see, lock it with a password. Protect PDF adds an AES 256-bit password inside your browser, so nothing is uploaded, and whoever has the file still needs the password. For ID copies, also write the purpose and the date across them with Add Watermark before you lock them. And if a website has to read the file, don't lock it: send it the way the website asks.

The rest of this post goes through who needs what, a routine in the right order, how to choose and pass on the password, and what a lock does not do.

For the plain steps of adding a password, without the advice on who needs what, see How to password protect a PDF for free.

Which paper, which protection

A password keeps strangers out of a file. A watermark says what a copy is for. They do different jobs. This table is a guide for common situations:

The Aadhaar and PAN case is worth a word. A copy sent to a private party can be reused for something you never agreed to. Writing "for rental agreement, 12 October 2026" across it makes that harder. The post Watermark Aadhaar, PAN or ID copy for KYC shows how. A watermark can't hide a number, and it can't stop copying, but it records what the copy was for.

A routine, in the right order

The order matters, because a locked file can't be changed by other tools unless you take the lock off first. So lock last:

1. Finish the document. Join pages with Merge PDF, take out pages you don't need with Split PDF, turn sideways pages with Rotate PDF.
2. Make it the right size. If the file has to fit a limit for email or chat, shrink it with Compress PDF.
3. Watermark ID copies with the purpose and the date.
4. Protect it last. Open Protect PDF, add the file, type a password twice and press Protect PDF. The copy is saved with -protected at the end of its name, and your original stays as it was.
5. Test the copy. Open the new file once, type the password the way you will tell it, and check that it opens and that every page is there.
6. Send the file, and tell the password another way: in a call, a text message or in person, not in the same chat or email.
7. Tidy up. Delete the copies you no longer need, especially on a shared phone or a computer you don't own.

Protecting is quick. In our tests, a two-page statement took 0.3 seconds, a 14-page paper 0.4 seconds, and a 117-page textbook 0.8 seconds. A phone may take longer. The lock adds almost nothing to the size: the 47.8 MB scan stayed 47.8 MB.

Choosing the password, and why it matters

An AES 256-bit lock can't be broken by trying keys, so someone who wants to read your file without the password has one way in: guessing it. Programs that do this try passwords one after another, starting with the most likely ones.

We tested how fast our own code checks passwords: about 770 a second on one processor core of our test computer. At that pace, all 1 million six-digit numbers, like a PIN or a date, take about 22 minutes. All four-word phrases made from a list of 2,000 common words, 16 trillion of them, take about 660 years. Programs built for guessing, using graphics cards or many computers, are many times faster, so a short password, or one made from a date or a name, can still fall.

• Use three or four unrelated words, like mango kettle river seven. Easy to remember, type and say.
• Don't use what people know about you: your name, birthday, phone number, PAN or account number, a pet's name, your city.
• Don't reuse the password of your email or bank. If this one becomes known, your accounts stay safe.

Because the person opening the file has to type the password, avoid characters that are hard to read out, like a capital I and a small l. Locked PDF won't open for the other person? goes through the common typing problems.

What a password does not protect

A lock is strong, and it has limits. Know them so you rely on it only where it works:

• The person with the password can do anything. They can save an unlocked copy, print it, take a screenshot or pass it on with the password. A password keeps strangers out; it doesn't control what the people you trust do afterwards.
• The file name and size are visible, and so are parts of how the file is built, like how many pictures it holds. Give the file a plain name, like statement.pdf, not "loan-details-for-ramesh-salary-60000.pdf".
• Blocks on printing and copying are requests, not locks. Many PDF apps follow them and some ignore them, and tools that remove them are easy to find. To keep something from a person, don't give them the password to open it.
• It doesn't prove the file is genuine. A password keeps a file private; a digital signature shows it hasn't changed. A PDF with a digital signature loses it in the protected copy, so keep the signed original if the signature matters.
• It protects the copy, not your phone. The original unlocked file is still on your device. Delete it or keep it somewhere private.

For the full picture of what the blocks do, see How to stop others copying, printing or editing a PDF.

WhatsApp, email and ZIP files

• On WhatsApp or email, attach the locked PDF as a file. A phone may show only a preview of a locked file; ask the receiver to save it and open it in a PDF viewer or a browser.
• Several files, one password. Protect PDF can lock many files at once with the same password, and a Download all button saves them in one ZIP file. The ZIP itself has no password: each PDF in it is locked. If you would rather send one file, join them first with Merge PDF, then protect the one file.
• Different passwords for different people need separate rounds: protect for one person, change the password, and protect again.
• Don't send the password where the file is. If the chat is read by someone else, they get both.

When not to lock the file

A password can get in the way when a website or an office has to read the file. Many upload portals can't accept password-protected PDFs: the site must read your file to check it, and it can't without the password. If a locked file is turned away, send the unlocked file and rely on the website's own security. If you only have the locked copy, Unlock PDF makes an unlocked copy, when you type the password you know.

Also don't lock a file you want a recruiter or an officer to open at a glance. And never lock the only copy: Protect PDF makes a new file and leaves the original untouched, so keep that original somewhere safe. A forgotten password can't be recovered by anyone.

Doing it on your phone

There is nothing to install. On Android, open Protect PDF in Chrome or another up-to-date browser, tap Choose PDF files, type the password twice and tap Protect PDF. The copy goes to Downloads. On an iPhone, use Safari, pick the file from the Files app, and the copy usually goes to Downloads in the Files app. On a phone, the keyboard may start with a capital letter or change a word as you type, so use the eye button to see what you typed before you press the button. Tested through our independent tests and our agentic testing workflow, in headless Chromium at phone and computer sizes. These tests don't cover Safari or Firefox, and a phone may be slower than our test computer.

Your file and password stay on your device

A website that uploads your file and your password to lock it has seen the very things the lock is meant to keep secret. Protect PDF doesn't have an upload step. It never sends your files or passwords anywhere. The page contacts only this site and Google's ad service, which shows the ads that keep the tools free, and our code never gives your files to the ad code. There is no account and no watermark of ours on your file. The privacy policy has the details.