Protect PDF with a password

What Protect PDF does, and when to use it

Protect PDF makes a copy of your PDF that can only be opened with a password you choose. Everything inside the copy, its text, pictures, form answers and attachments, is scrambled with AES 256-bit encryption, and only the password unscrambles it. Any PDF app asks for the password before it shows the file. If you like, you can also block printing, copying and changes with a second password. It all happens inside your browser: the file and the password stay on your phone or computer.

A password is worth adding whenever a PDF holds something private and travels or sits where others could find it:

• Sending documents by email or chat, such as an ID card scan, a salary slip, bank statements for a loan, or a signed agreement.
• Storing them in a cloud folder, on a USB drive or on a computer that others use.
• Sharing medical reports, tax papers and contracts, with a doctor, an accountant or a lawyer.
• Handing out a document to a group, like a class or a team, when only the group should read it.

The password protects the file wherever it goes: in a sent email, in a forwarded message, in a backup. Whoever has the file still needs the password.

Step by step: locking a PDF on this page

1. Add the PDF. Press Choose PDF files and pick one or several, drop them anywhere on this page, or paste one you copied. To try it first, press Try with a sample file: it makes a two-page sample statement.
2. Type a password, twice. Type it in the first box, and the bar under it shows how hard it is to guess. Type it again in the second box, which says when the two match. The eye button in each box shows what you typed.
3. Block printing or copying, if you like. Tick Also block printing, copying or changes, choose what to block, and type an owner password, different from the first. Leave it unticked to lock the file with just the password, which is enough for most people.
4. Protect and download. Press Protect PDF. Each file gets a Download button. Its name ends in -protected, like statement-protected.pdf, so your original stays as it was. Open the new file once to check that it asks for the password and that the password opens it.

The passwords are kept only in this page's memory while it is open. Change a password or a setting after protecting, and the files are ready to protect again with the new one.

Choosing a password that is hard to guess

An AES 256-bit lock can't be broken by trying keys, so someone who wants to read a locked PDF without the password has only one way in: guessing the password. Programs that do this try passwords one after another, very quickly, starting with the most likely ones. The question is how long your password holds out.

PDF's AES 256-bit lock makes guessing slow on purpose: checking one password takes many rounds of work. In a test of our own code on one processor core of our test computer, it checked about 770 passwords a second. At that pace, all 1 million six-digit numbers, like a PIN or a date, take about 22 minutes, while all four-word phrases made from a list of 2,000 common words, 16 trillion of them, take about 660 years. Programs built for guessing, running on graphics cards or many computers at once, are many times faster than that, so a short password, or one made from a date or a name, can still be found quickly. Every extra character or word multiplies the work.

So the length of the password matters most, and whether it is something a person or a program would guess. Good ways to make one:

• Three or four unrelated words, like mango kettle river seven. That is easy to remember and type, and long enough to be hard to guess.
• Or 12 or more mixed characters, from a password manager, which also remembers it for you.
• Avoid what people know about you: your name, date of birth, phone number, PAN or account number, a pet's name or your city. These are the first things someone who knows you would try, and lists of common choices come first in every guessing program.
• Avoid common patterns: password, 123456, qwerty, a name followed by 123, or a word with @ for a, such as p@ssword.
• Use a new password, not one from your email or bank account. If the PDF's password becomes known, your accounts stay safe.

The bar under the password box is a rough guide. It counts the length and the kinds of characters, and lowers the score for things guessed early: runs like 1234, numbers of 8 digits or fewer such as a PIN or a date, dates in general and common words. Weak means it could be guessed quickly; Fair is better but short; Good and Strong are long enough for most uses. It can't know what someone knows about you, so a long password made from your own details still isn't a good one. The check happens on this page, like everything else: the password isn't sent anywhere to be checked.

If you forget the password

There is no way back. The password is the only key to the protected copy: it isn't stored in the file, it isn't stored by us, and we never saw it. A forgotten password can't be reset, recovered or looked up by anyone, and a good one can't be guessed either. That is the point of the lock, but it also works against you if the password is lost. So:

• Keep the original. Protect PDF makes a new file and leaves your original untouched. Keep the original somewhere safe and private, and send the protected copy.
• Write the password down where it is safe, such as in a password manager, or on paper kept with your important papers.
• Open the protected copy once before you send it or delete the original, to make sure the password you meant is the one that works.

Asking you to type the password twice catches most typing mistakes, and the eye button lets you read it before you press Protect PDF.

AES 256-bit: the lock it uses

PDF files have been locked in several ways over the years: RC4 with 40-bit and 128-bit keys in older files, AES 128-bit, and AES 256-bit, the newest. Protect PDF always uses AES 256-bit, in the form the current PDF standard, PDF 2.0, describes. AES is the encryption banks, websites and phones use, and with a 256-bit key there are far too many keys to try.

Every string and stream of the file, the parts that hold its text, pictures, fonts, form answers, details like the title and author, and attachments, is scrambled with a key made at random on your device for this file. The password unlocks that key. Each part also gets its own random starting value, so two copies of the same file locked with the same password look completely different.

AES 256-bit has been part of the PDF standard for years, so up-to-date PDF apps open it. In our tests the protected copies asked for the password, and opened with it, in the PDF readers that Chrome and Edge (PDFium) and Firefox (pdf.js) are built on, in Poppler, which many Linux apps use, in pypdf, and in the qpdf checker. Very old PDF apps, from before AES 256-bit came to PDF, can't open it.

Blocking printing, copying and changes

Besides the password to open it, a PDF can carry restrictions: requests to PDF apps not to print it, not to let text be copied, or not to allow changes. Tick Also block printing, copying or changes and choose:

• Printing: the app's Print button is greyed out.
• Copying text: text can't be selected and copied, and pictures can't be taken out. Screen readers that read the text aloud for blind people are still allowed, as the PDF standard asks.
• Changes: the file can't be edited or commented on, or have pages added, removed or turned. Filling in its form fields stays allowed, so a form you send can still be filled in.

Restrictions need a second password, the owner password, which lifts them in apps that ask for it. Use one that is different from the password to open the file, and keep it to yourself. People who know only the first password can open and read the file, but get the restrictions.

Be clear about what restrictions are. They don't scramble anything more: anyone who can open the file can read all of it. They are a request that PDF apps are meant to follow, and many do, such as Adobe Acrobat Reader. But some apps ignore them, and tools that remove them are easy to find, including our own Unlock PDF. A screenshot or a photo of the screen gets around them too. So blocks stop casual printing and copying by honest people, which is sometimes all you want, but they don't stop someone who is determined. To keep something from a person, don't give them the password to open.

What a PDF password does, and doesn't, protect

It helps to know exactly what a password does for a PDF, so you can rely on it where it works and use something else where it doesn't:

• It protects what's inside, wherever the file goes. With AES 256-bit and a password that is hard to guess, the text, pictures, form answers and attachments can't be read without the password, whether the file sits in an inbox, on a USB drive or in a cloud folder, or is forwarded to the wrong person.
• It is only as strong as the password. A short password, or one made from your name and date of birth, can be guessed. Nothing in the lock makes up for a weak password.
• Anyone with the password can do anything. A person who can open the file can save an unlocked copy, print it, screenshot it or pass it on with the password. A password keeps strangers out; it doesn't control what the people you trust do afterwards.
• Restrictions are not a lock. As explained above, blocks on printing and copying are requests that some apps ignore.
• Some things aren't hidden. A locked PDF still shows its file name and size, and parts of how it is built, such as how many pictures it holds and their sizes in pixels: the lock scrambles what the file holds, not how it is put together. Give the file a plain name, like document.pdf, if its name would give something away.
• It doesn't prove who made the file. A password keeps a file private; it doesn't show that the file is genuine or unchanged. That is what a digital signature does.
• It protects the copy, not your device. The original, unlocked file is still on your phone or computer. Delete it, or keep it somewhere private, if that matters.

For most everyday sharing, a PDF password does the job well: it is simple, works on every device, and needs no account or app at the other end.

What stays the same in your PDF

Protecting scrambles every part of the file and writes it again with the lock. Nothing on the pages is redrawn, so once the password is typed, the copy looks and works exactly like the original:

• Every page, in the same order, with the same text, fonts and pictures. Text stays searchable and copyable unless you block copying.
• Links and bookmarks still lead to the right pages and websites.
• Forms keep their fields and anything already filled in.
• Attachments and the document's details, such as its title and author, stay, locked like the rest.
• The size barely changes. Scrambling doesn't make a file bigger by itself; each part grows by a few bytes.

One thing changes as a result: a PDF with a digital signature, the coded seal that shows a document hasn't changed since it was signed, no longer carries a valid signature in the protected copy, and its row says so. Keep the signed original if the signature matters.

Real results from our tests

We protected these PDFs in Chromium 141, the open-source browser Google Chrome is built on, on a Linux computer with 4 processor cores and 16 GB of memory, with a password to open them. Times are what the page reported from pressing Protect PDF to the Download button, the middle of three tries; your device may be faster or slower.

• 0.3 sto protect the sample statement
• 2.2 sfor a 42-page, 47.8 MB scan
• 47.8 MBbefore and after for that scan: the lock adds almost nothing
• 0 bytessent to any server

Every protected copy asked for its password in pypdf, PDFium (the PDF engine inside Chrome), Poppler and qpdf, refused no password and a wrong one, and opened with the right one, with every page, the same text on every page as the original and the same look when drawn. The textbook kept all 35 of its bookmarks and 509 links, and the form all 8 filled-in answers. In pdf.js, the PDF reader built into Firefox, a protected copy asked for the password too, and showed all its pages, with their text, once it was typed. With blocks on, Poppler, pypdf and qpdf all showed printing, copying and changes as not allowed, and the owner password opened the file in each.

Copies are often a little smaller than the original, because the protected copy packs its small internal parts more tightly; the lock itself adds 17 to 32 bytes to each part. Even the smallest files take a few tenths of a second: most of that goes into the password step of AES 256-bit, which is slow on purpose, as explained in choosing a password.

The largest file we tried was a 1,000-page scan of 1.11 GB: it was protected in 64.5 s. While the 454.8 MB scan was protected, the browser used about 1.8 GB more memory than when idle, because the file and the protected copy are both held in memory; for the 47.8 MB scan it was about 0.2 GB.

Sharing the file and its password safely

A locked file is only as private as its password, so the way you pass the password on matters as much as the lock:

1. Send the password another way. Not in the same email or chat as the file: if that message reaches the wrong person, or the account is broken into, they get both. Tell the password in a phone call, a text message or in person, or send it in a different app.
2. Agree on a password ahead of time with people you send files to often, such as your accountant, and use it for each file.
3. Don't put the password in the file name or in the email's subject.
4. Check the file opens on your side before you send it, so the person you send it to doesn't need to come back for a new copy.

Some portals and offices can't accept password-protected PDFs at all. For an upload that must be readable by the website, send the unlocked file and rely on the website's own security; if a locked file was turned away, our Unlock PDF removes a password you know.

Protecting several PDFs at once

Add as many PDFs as you like, all at once or a few at a time with Add more PDFs. Every file gets the same password and the same blocks; to give files different passwords, protect them in turns, changing the password between them. A file you added by mistake has an X button to remove it.

Files are locked one after another, each in its own row with its own Download button. When two or more are done, a Download all button saves them in one ZIP file, protected-pdfs.zip. The ZIP itself has no password: each PDF in it is locked. To send several files under one password, you can also join them first with Merge PDF, then protect the one file.

A PDF that already has a password

Protect PDF can change the password of a file that already has one. When you add a file that is locked, its row says so and shows a box for its current password. Type the current password there, and the new password and blocks above, then press Protect PDF. The old lock is taken off with the current password and replaced by the new AES 256-bit lock, and the row says which lock was replaced.

A file that only has restrictions, and opens without a password, needs nothing in that box. If the current password is wrong, the row says so and nothing is made. To just remove a password, without adding a new one, use Unlock PDF.

Passwords in Hindi and other languages

AES 256-bit stores passwords as Unicode text, so a password can use letters of any language, like Hindi, Tamil, Bengali or accented letters such as é, as well as English letters, digits, spaces and punctuation. In our tests, files protected with passwords in Hindi, Japanese and German opened with those passwords in every reader we tried.

A few characters are refused, with a message saying why, because PDF apps would read them in different ways and the file might not open everywhere: emoji, invisible characters and tabs, special spaces and full-width letters, and some mixes of right-to-left and left-to-right letters. The PDF standard tidies up passwords with a step called SASLprep before using them, and only passwords that this step leaves unchanged open the same in every app, so those are the ones Protect PDF accepts. Passwords can be up to 127 bytes long, which is 127 English letters or about 40 Hindi letters.

Remember that the person opening the file needs to type the same letters, so a password in another script is only a good idea if they have that keyboard.

Private: your file and password stay on your device

A file worth locking is a file worth keeping private, and so is its password. A website that uploads both to lock the file has seen the very things the lock is meant to keep secret. With NoUploadPDF, the file and the password never leave your phone or computer. Your browser reads the file, and our lock engine, written in Rust and compiled to WebAssembly, locks and writes it in a background worker on your device. The secret key is made with your browser's cryptographic random number generator. The password is forgotten when the page closes; it is never saved, logged or sent.

The page can't send your files or passwords to another site, even by mistake. Its Content Security Policy, a rule the website gives your browser, tells the browser to block the page from sending data to any other site. There is no account to create and nothing to sign in to. If you like, you can check in your browser's network panel that nothing is uploaded.

Compared with tools that upload your files

Many online tools that add a password to a PDF upload the file and the password to their servers, lock it there and send it back. Here is how that compares with working on your own device:

Many upload-based tools are well made, and some promise to delete files after a while. A file and a password that never leave your device need no such promise.

Use it on Android, iPhone, Windows and Mac

There is nothing to install: Protect PDF runs in an up-to-date browser on phones, tablets and computers.

• Android

  Open this page in Chrome or another up-to-date browser and tap Choose PDF files. Type the password twice and tap Protect PDF; the copy is saved to Downloads, ready to attach to an email or a chat.

• iPhone and iPad

  Use Safari. Tap Choose PDF files and pick a file from the Files app. The protected copy usually goes to Downloads in the Files app, and can be shared from there.

• Windows, Mac, Linux, Chromebook

  Click Choose PDF files, or drag PDFs from a folder and drop them anywhere on the page. The protected copies go to your Downloads folder.

On a phone, the keyboard may start with a capital letter or change a word as you type. Use the eye button to see what you typed before you protect the file, and think of how the person opening it will type the password on their device.

Problems and quick fixes

• The button says "Type the password twice". The two boxes don't match yet. Use the eye buttons to compare them.
• The protected copy doesn't open with the password. Check capital letters, Caps Lock and the keyboard language on the device opening it. The original is unchanged, so you can protect it again with a password that is easier to type.
• "That current password didn't open it." The file was already locked, and the password typed in its row is not its password. Type its current password, or remove its lock first with Unlock PDF.
• "This password has a character that can't be used." Emoji, special spaces and a few other characters are read differently by different PDF apps. Type the password without them.
• A website won't accept the protected file. Many upload portals can't read locked PDFs. Upload the original instead.
• "Too big for this browser's memory." Close other tabs, or use a computer, which usually has more memory than a phone.

Limits

• No password recovery. A forgotten password can't be recovered, by us or anyone. Keep the original.
• Passwords only. It locks with a password, not with digital certificates, and doesn't make files that expire or can be opened only on certain devices.
• Restrictions can be removed. Blocks on printing, copying and changes are followed by many PDF apps, not all.
• Very old PDF apps may not open AES 256-bit files.
• Signatures. A digital signature isn't valid on the protected copy.
• Damaged files. A file with damaged parts is refused rather than locked with parts missing; saving it again from a PDF app usually fixes it.
• Memory. We set no size limit, but the file has to fit in your device's memory, along with the copy being made. Phones have less than computers.

PDF password terms, explained

Password to open

The password a PDF app asks for before it shows a locked file. Also called the user password or document open password.

Owner password

A second password that lifts restrictions in apps that ask for it. It also opens the file. Also called the permissions password.

Restrictions

Blocks on printing, copying or changes, which PDF apps that respect them obey. Also called permissions.

Encryption

Scrambling data with a secret key so it can only be read with that key. In a locked PDF, the password unlocks the key.

AES 256-bit

The Advanced Encryption Standard with a 256-bit key, the strongest lock in PDF, used across banking and the web.

SASLprep

A rule for tidying up typed text, which the PDF standard applies to AES 256-bit passwords, so the same password typed on different devices becomes the same bytes.

Password manager

An app that makes strong passwords and remembers them for you, behind one main password.

Digital signature

A coded seal that shows who signed a PDF and that it hasn't changed since. A changed copy no longer carries a valid one.