Protect PDF with Password

Before you email a payslip, a tax return or a signed contract, lock it with a password. This tool encrypts the PDF with AES-256 — the strongest option in the PDF standard — and can also restrict printing, copying and editing. Encryption happens in your browser, and before you download, the result is reopened with an independent PDF reader to confirm it asks for the password and opens correctly with it.

How to use this tool

1. Choose the PDF (or several to lock with the same password).
2. Type the password twice. Use 8 or more characters mixing words, digits and symbols.
3. Optionally set a permissions password and untick what others may not do: print, copy, edit or comment.
4. Download the protected PDF and send the password separately — by phone or a different app, not in the same email.

Formula

AES-256 (revision 6): a random 256-bit file key encrypts every string and stream with AES-CBC. The key is stored wrapped twice — once under a hash of the open password and once under the permissions password — using the hash of ISO 32000-2 Algorithm 2.B (at least 64 rounds of AES and SHA-256/384/512).

The AES-128 option uses the older revision 4 scheme (MD5-based key, AES-128 per object) for PDF readers older than about 2010. Both are standard PDF encryption that Acrobat, Chrome, Edge, Firefox, macOS Preview and phone apps open.

Example

Protecting a 3-page payslip with the password Mango-River-82 and default permissions gives payslip-protected.pdf. Opening it shows a password prompt; with the password it opens to the same 3 pages, and printing, copying and form filling remain allowed while editing is blocked.

Choosing a strong password

Length matters most: three or four unrelated words with a digit, such as Mango-River-82, are far harder to guess than a short mix like Pa$s1. Avoid birthdays and phone numbers, which are the first guesses for personal documents. There is no way to recover a forgotten password, so store it in a password manager.