Password protect a PDF for free, on any device

The short answer: four steps in your browser

You don't need to buy or install anything to put a password on a PDF. Protect PDF does it inside your browser, so your file never leaves your phone or computer:

1. Open Protect PDF in Chrome, Safari or another up-to-date browser. Press Choose PDF files and pick your PDF. On a computer you can also drop the file anywhere on the page.
2. Type a password, twice. A bar under the first box shows Weak, Fair, Good or Strong. The second box says when the two match. The eye button shows what you typed.
3. Press Protect PDF. The file gets its own Download button.
4. Download the copy and open it once. Its name ends in -protected, so statement.pdf becomes statement-protected.pdf. Your original is not changed. The new file asks for the password before it shows a page. On a computer it goes to your Downloads folder.

The lock is AES 256-bit encryption, which means the file is scrambled with a secret key that only your password can unlock. AES is the kind that banks, websites and phones use. There is no sign-up, no watermark and no limit on how many PDFs you protect. Have several? Add them all, and each gets the same password, with a Download all button for one ZIP file.

What you get: a locked copy, and your original untouched

Protect PDF makes a new file. Everything inside it is scrambled: the text, the pictures, form answers, attachments, and details like the title and author. Only your password unscrambles it. Any up-to-date PDF app asks for the password before it shows the first page, and the lock stays with the file in a sent email, a forwarded message, a backup or a cloud folder.

Nothing on the pages is redrawn, so once the password is typed, the copy looks and works like the original: every page, link, bookmark and filled-in form answer stays, as the Protect PDF guide lists in full. Two things are worth knowing early. Very old PDF apps, from before AES 256-bit came to PDF, can't open the copy. And a PDF with a digital signature, the coded seal that shows a document hasn't changed since it was signed, no longer carries a valid signature once protected. Keep the signed original if the signature matters.

On a phone: Android and iPhone

The whole job works on a phone, with no app. What needs care is the PDF itself. The browser's file picker can only choose files saved on the phone, or in a storage app linked to it. A PDF that sits inside a WhatsApp chat or an email is not a saved file yet.

Before you start: save the PDF

• iPhone and iPad: open the PDF in WhatsApp or Mail, tap Share and choose Save to Files.
• Android, from Gmail: tap the download arrow on the attachment. It goes to Downloads.
• Android, from WhatsApp: the picker doesn't always show WhatsApp's folder. Open the file in the chat and use Share to save it to Drive or your phone's files.

Locking it

1. Open Protect PDF in Chrome on Android, or in Safari on iPhone and iPad.
2. Tap Choose PDF files and pick the PDF. On an iPhone the picker comes from the Files app.
3. Type the password twice and tap Protect PDF. Then tap Download.

On Android the copy goes to Downloads. On an iPhone it usually goes to Downloads in the Files app. To send it, attach it from there: in WhatsApp, use the attach button and choose Document. Keep the page on screen until the Download button appears, because a phone may pause a page you switch away from.

Phone keyboards like to start a word with a capital letter, or to change a word as you type, so tap the eye button to see what you typed. Remember the person who will type it on their own phone, too: plain words are easier to get right than symbols.

Big files on a phone

We set no limit on file size. The real limit is your device's memory, and phones have less than computers. In our tests (Chromium 141, the browser Chrome is built on, on a Linux computer with 4 processor cores and 16 GB of memory), the page reported these times, from pressing Protect PDF to the Download button, each the middle of three tries.

Your phone may be slower. For huge files, memory matters more: while the 454.8 MB scan was protected, the browser used about 1.8 GB more memory than when idle, because the file and the protected copy are both held in memory. For the 47.8 MB scan it was about 0.2 GB. If you see "too big for this browser's memory", close other tabs or use a computer.

Choosing a password that holds up

An AES 256-bit lock can't be broken by trying keys. So someone who wants to read your file without the password has one way in: guessing it. That makes the password the weak spot, and worth a minute of thought.

The lock makes guessing slow on purpose. In a test of our own code on one processor core of our test computer, about 770 passwords a second were checked. At that pace, all 1 million six-digit numbers, like a PIN or a date, take about 22 minutes. All four-word phrases made from a list of 2,000 common words, 16 trillion of them, take about 660 years. Programs built for guessing, running on graphics cards or many computers at once, are many times faster, so read these as a comparison between kinds of passwords, not a promise.

The usual mistakes, and what to do instead:

A way that works for most people

Pick three or four words that don't belong together and that you can picture, such as a street, a fruit, a sound and a colour. Choose them yourself, not a well-known saying or a line from a song, which others know too. Aim for 10 or more characters (the page suggests this as well), with spaces or hyphens between the words if you like. If you use a password manager, an app that makes strong passwords and remembers them, let it make 12 or more mixed characters.

The bar under the password box is a rough guide. It counts length and kinds of characters, and marks down dates, runs like 1234 and common words. Aim for Good or Strong. It can't know what people know about you, so a long password built from your own details is still a poor one. The check happens on the page, and nothing is sent anywhere.

Hindi, Tamil and other letters work in a password. Emoji and a few special characters are refused, with a message saying why. Use another script only if the person opening the file can type it on their own keyboard.

Sending the file, and the password, safely

1. Send the password another way. Not in the same email or chat as the file, because if that message reaches the wrong person, they get both. Use a phone call, a text message, or a different app.
2. Keep it out of the file name and the subject line.
3. Say that it is exact. Capital letters count, and a keyboard set to another language gives other letters.

Gmail attachments can be up to 25 MB, and bigger files are sent as a Google Drive link. It is the same locked file either way. If the person has no PDF app, our PDF Viewer opens a locked PDF in the browser, with a password box on the page.

Some portals and offices can't read a password-protected PDF. For an upload that a website must read, send the unlocked file. If a locked file was turned away, Unlock PDF makes a copy without the password, as long as you know it.

Finish your edits first, then lock the file

Once a PDF needs a password to open, most tools can't work on it. Merge PDF, Split PDF, Organize PDF, Rotate PDF, Resize PDF, Add Watermark, Add Page Numbers and our compressor all say they can't use a file that needs a password to open, until the password is removed. PDF Viewer, PDF to JPG and Compare PDF can open a locked file if you type its password. So lock last. A good order:

1. Put the pages right. Join files with Merge PDF, take pages out with Organize PDF, or turn a sideways page with Rotate PDF.
2. Add what should show on the pages, such as a watermark with Add Watermark or page numbers with Add Page Numbers.
3. Make it smaller if it must fit an email or a form, with the compressor or Resize PDF. The lock changes the size very little: our 42-page scan was 47.8 MB before and after. A very small file can grow a little (the sample statement went from 2.9 KB to 3.1 KB), so if a form has a strict limit, such as 100 KB, leave a little room under it.
4. Protect it, then open the copy once to check it.

Keep the unlocked original in a private folder. To change the file later, change the original and protect it again.

You can also change the password of a file that is already locked. Add it to Protect PDF, type its current password in its row and the new password above, and the old lock is replaced by the new AES 256-bit lock.

Other ways to add a password, compared

You may already own a program that can do this. Menus change between versions, so look in the save or export options.

• Preview on a Mac can add a password when you export a PDF. It is built in, private and quick, but only on a Mac.
• Word on Windows and LibreOffice can add a password while saving a document as PDF. That is handy when you still have the document. It doesn't help with a PDF you received or scanned.
• Adobe Acrobat, the paid app, can protect a PDF with a password. The free Reader is for reading.
• Online tools: most online PDF tools upload your file to their servers, and a tool that locks it there needs your password too. Free plans of upload-based tools often cap the file size or the number of tasks.

Protect PDF works on any PDF, on a phone as well as a computer. It always uses AES 256-bit, where other tools may use an older lock, and your file and password never leave the device.

Check the locked copy before you send it

Open the new file in the kind of app the other person will use:

1. It should ask for a password first, before it shows any page.
2. Try a wrong password. It should be refused.
3. Type the right one and scroll through every page. Are they all there, in order, the right way up?

The lock scrambles what the file holds, not how it is put together. A locked PDF still shows its file name and size, and parts of its build, such as how many pictures it holds and their sizes in pixels. If the name gives something away, like salary-slip-priya-march.pdf, rename the copy on your device before you send it.

If something goes wrong

• "I forgot the password." Then nobody can open the protected copy: not you, not us, not anyone. The password isn't stored in the file or by us. If you still have the original, protect it again with a new password, and this time write the password somewhere safe.
• The button says "Type the password twice". The two boxes don't match yet. Tap the eye buttons and compare them letter by letter.
• A message says the password has a character that can't be used. Emoji, special spaces and a few other characters are read differently by different PDF apps. Type the password without them.
• The other person says the password doesn't work. Ask how they are typing it. Phone keyboards often add a capital letter at the start, and a keyboard set to another language gives other letters. The original is unchanged, so you can protect it again with a password that is easier to type.
• Their app can't open the file at all. Very old PDF apps can't open AES 256-bit files. An up-to-date browser can, or our PDF Viewer, which asks for the password on the page.
• You can't find the downloaded copy. On Android, look in Downloads. On an iPhone, look in Downloads in the Files app. On a computer, look in your Downloads folder. Its name ends in -protected.
• The file's row says "Already locked with a password". Type its current password in the box on its row, or remove the lock first with Unlock PDF.

More fixes are in the problems and fixes part of the guide.

What a password can't do

A password keeps strangers out. It doesn't control what the people you trust do next. Anyone who has the password can print the file, take screenshots, save an unlocked copy or pass it on with the password. It also doesn't prove that a file is genuine, which is what a digital signature is for.

Two common jobs need more than a password:

• Copies of ID cards and certificates. First add a watermark with the purpose and the date, using Add Watermark, such as "For bank account opening only". Then lock the marked copy. Do it in that order, because Add Watermark can't use a locked file.
• Stopping people from printing, copying or editing. Protect PDF can ask PDF apps to block those, but it is only a request. A separate article, how to stop others copying, printing or editing a PDF, explains what these blocks really do and where they fail.

For everyday sharing, a PDF password does its job well, and needs no account or app at the other end.