Password Protect a PDF — AES-256 Encryption in Your Browser
Add a password to a PDF so it cannot be opened without it. The file is encrypted with AES-256, the strongest cipher the PDF standard defines, and you can also block printing, copying or editing. Everything happens on your device.
To finish a document off, Rotate PDF fixes sideways scans and Add Page Numbers numbers the pages before you share it.
How to use the Protect PDF
- 1 Choose the PDF you want to protect.
- 2 Type the password that will be needed to open it — or click Generate a strong password.
- 3 Optionally open the owner-password section to set a separate master password and untick printing, copying or editing.
- 4 Click Protect PDF and download the encrypted file. Keep the password safe; it cannot be recovered.
How to protect a PDF
- Choose the PDF you want to lock.
- Type the password that will be required to open it.
- Optionally set an owner password for full access, and untick the permissions you want to withhold.
- Download the protected PDF — the original stays unlocked on your device.
Open password vs owner password
The open password — also called the user password — is the one a reader must type before the document will display at all. Without it the content is genuinely unreadable, because the file itself is encrypted.
The owner password grants full control and bypasses the permission restrictions. Leave it blank and it defaults to the open password, which is what most people want. Set a different one if you need to hand out restricted copies while keeping a master key for yourself.
What the permission settings really do
Being straight about this: printing, copying and editing restrictions are a request recorded in the file, not a cryptographic lock. The document is encrypted with one key, and a viewer that chooses to honour the flags will grey out Print or Copy — but a reader that ignores them can still print and copy.
So treat permissions as a deterrent that stops casual misuse, not as a security boundary. If content must genuinely be unextractable, do not ship it in a PDF at all.
Why AES-256, and why it matters here
AES-256 is the current standard, and it is what this tool writes. Older tools often produce RC4-40 encryption from the early 1990s, which is trivially broken with modern hardware, or AES-128, which is fine but no longer the recommendation.
The encryption uses the Web Crypto API, drawing random values from the operating system. That matters more than it sounds: a PDF encrypted with a predictable random source can leak its key, which is exactly how several real-world PDF protections have been defeated.
Is it safe to use?
The password never leaves your browser and is never stored or transmitted. The document is read, encrypted and written again in memory using JavaScript, so no copy of your unlocked file or your password reaches any server.
Frequently asked questions
How do I password protect a PDF online?
Choose the file, type the password you want, and download the protected copy. The PDF is encrypted with AES-256 before it is saved, so the download will not open without that password. Nothing is uploaded at any point.
What is the difference between the open password and the owner password?
The open password — also called the user password — is required before the document displays at all. The owner password grants full access and bypasses the permission restrictions. Leave it blank and it defaults to the open password, which is what most people want.
Can printing and copying really be blocked?
Partly, and it is worth being precise. Permissions are a request recorded in the file, not a cryptographic lock: a viewer that honours them greys out Print and Copy, but a reader that ignores them can still print. Treat them as a deterrent against casual misuse, not as a security boundary.
What encryption does this use?
AES-256, which is the strongest cipher the PDF standard defines and the only one ISO 32000-2 still recommends. Older tools often produce RC4-40 encryption from the early 1990s, which is trivially broken today. The random values come from the Web Crypto API, so the key is not predictable.
Can I remove the password later?
Yes, but only if you know it — open the protected PDF in a reader, enter the password, and save or print it to a new file. There is no way to recover a forgotten password, which is why the tool tells you to store it safely before you download.
Does the password get sent anywhere?
No. The password is used locally to derive the encryption key and is never transmitted or stored. The document is read, encrypted and written again in memory, so no copy of your unlocked file reaches any server.
Related PDF Tools
You might also need
Tools from other categories that people pair with the Protect PDF: