What does password-protecting a PDF actually do?
It scrambles the file so it can't be read without a password. Protect PDF takes a PDF, asks you for a password twice, and gives you back the same document encrypted with AES-256. Open it anywhere and the reader asks for the password before it shows a single page. Without it, the file is noise.
That sounds obvious, but "password protect PDF" covers two very different things, and most of the confusion starts here. A PDF can carry two kinds of password:
- An open password (the spec calls it the user password). The contents are encrypted. No password, no document. This is real protection.
- An owner password with no open password. Anyone can open and read the file. It just carries flags saying "please don't print" or "please don't copy". Each reader decides whether to respect them, and plenty don't.
This tool does the first one and only the first one. We left the second out on purpose. A "no printing" flag on a readable file is a polite request, and our own Unlock PDF tool clears one in a click. Calling that security would be a lie, so we don't offer it.
Everything happens in your browser. The file is read off your disk, encrypted on your machine, and written back as a download. Nothing is uploaded, and there's no account or daily limit. It costs nothing to use.
How to password protect a PDF
Protect PDF takes four steps and about thirty seconds:
- Drop the PDF onto the box, or click it and pick one. Up to 100 MB, any number of pages.
- Type a password, then type it again in Confirm. The Show button reveals what you typed, if you want to check it.
- Click Protect PDF, or press Enter. The button stays grey until the two passwords match.
- Click Download protected PDF. The file keeps its name with
-protectedon the end.
That's the whole flow. No welcome tour, no settings page, no choice of five encryption levels you'd have to research first. There's one level, and it's the strongest one the format has.
How PDF encryption works
The PDF format has been through five encryption schemes since 1996, and the old ones never went away. A reader still has to open a file from 2001, so tools can still write 2001-grade encryption. Some quick tools do. Here's the line-up:
| Scheme | Key | Arrived with | Where it stands today |
|---|---|---|---|
| RC4, revision 2 | 40-bit | PDF 1.1 (1996) | Broken. A laptop recovers the key without ever needing the password. |
| RC4, revision 3 | 128-bit | PDF 1.4 (2001) | RC4 itself is considered broken. Deprecated in PDF 2.0. |
| AES, revision 4 | 128-bit | PDF 1.6 (2004) | Sound cipher, but a fast password hash makes guessing cheap. |
| AES, revision 5 | 256-bit | PDF 1.7 extension (2008) | Had a flaw that made password guessing far too fast. Deprecated. |
| AES, revision 6 | 256-bit | PDF 1.7 extension, standard in PDF 2.0 (2017) | Current. The only scheme Protect PDF writes. |
Revision 6 fixed the weak spot in revision 5, which was the step that turns your password into a key. Here's how it goes, start to finish.
A random file key. The document is encrypted with a 256-bit key picked at random, not with your password. Your password only guards that key.
A slow hash for the password. Your password is mixed with a random salt and run through at least 64 rounds that switch between SHA-256, SHA-384 and SHA-512. Each round depends on the last, so there's no shortcut. Every guess an attacker makes has to pay for the whole thing.
Every piece encrypted in place. Each page's content stream, font, image and text string is encrypted separately with AES-256 and its own random 16-byte starting block. Nothing is turned into a picture. Once the right password goes in, the reader gets back exactly the document you started with. Text selects and searches, links click, form fields fill.
Why the file gets a little bigger. Each encrypted piece gains its 16-byte starting block plus 1 to 16 bytes of padding, so 17 to 32 bytes per stream or string. On a normal document that adds up to a few kilobytes. Protect the same file twice with the same password and you get two different files, because the salts and starting blocks are random every time. Both open.
A worked example: protecting a 12-page report
Say you have report.pdf, 12 pages, about 3.4 MB, going to an accountant. You drop it into Protect PDF and it shows its name, size and page count. The cursor jumps to the password field.
You type hunter2-correct twice. Both fields match, there are no notes, and the button turns on. Click it and the result card reads 12 pages · 3.4 MB · AES-256, with a download named report-protected.pdf. Under it is one line worth taking seriously: "Save this password somewhere. We can't recover it — nobody can."
Now a second file: Signed lease.PDF, which carries a digital signature, and a lazier password, hunter2. The tool still lets you protect it, but two notes show up first:
- "Short passwords can be guessed offline. 12+ characters is safer." The password is 7 characters. The note never blocks you. It just tells you the truth.
- "Adding a password will invalidate this PDF's digital signature." A signature covers the file's exact bytes, and encryption changes every one of them.
The download comes out as Signed lease-protected.pdf. The capital-letter .PDF is handled, and the space in the name survives.
If the confirm field says hunter2-corect (one r short), the button stays off and you get "The passwords don't match. Retype the second one." While the confirm field still matches the start of the password, the tool stays quiet. It won't flash an error while you're halfway through the second field.
Picking a password that holds up
AES-256 won't be the weak point. Your password will. Once someone has a copy of the file, they can guess offline as fast as their hardware allows. Nothing locks them out after three tries and nothing logs the attempts. So the only defence is how many passwords they'd have to try.
To make that concrete, imagine an attacker who can test a billion passwords a second. That's generous, given how slow the revision 6 hash is, but it keeps the numbers simple:
| Password shape | Possible passwords | Time to try them all at 1 billion/sec |
|---|---|---|
| 8 lowercase letters | about 209 billion | about 3.5 minutes |
| 12 lowercase letters | about 95 quadrillion | about 3 years |
| 12 characters from the full keyboard (94 symbols) | about 476 sextillion | about 15 million years |
That's the reason for the 12-character note. Real passwords do worse than the table because people pick words, names and years, and attackers try those first. summer2024 falls long before random letters would. For something that has to hold, let the Password Generator make it, and keep it in a password manager.
Non-English passwords are welcome. pässwörd-2026 works, and so do Cyrillic, Greek, Chinese and emoji. Two limits exist so the file opens the same way in every reader:
- 127 bytes, not 127 characters. The format caps a password at 127 bytes of UTF-8. A plain letter is 1 byte,
äis 2, a Chinese character is 3. So 42 Chinese characters (126 bytes) are fine and 43 (129 bytes) are refused. Some readers quietly cut a long password short, and then the one you typed wouldn't open the file. We refuse it rather than trim it behind your back. - No look-alike or invisible characters. Full-width letters like
ｐａｓｓｗｏｒｄ１２３, a non-breaking space, a zero-width space, thefiligature: some readers rewrite these before checking the password and some don't. The same password would open the file in one reader and fail in another. The tool catches them and asks for standard characters.
Why this runs on your machine, not a server
The usual way to password protect a PDF online goes like this. Upload the confidential file to a stranger's server, so the stranger can make it confidential, then download it back. That's backwards. The moment you'd want encryption is the moment you shouldn't be handing the unencrypted file to anyone.
The rest of the pattern is familiar. Two tasks a day, then a paywall. A sign-up wall before the download. A monthly desktop subscription, priced per seat, sold to people who needed a password on one file. A fourteen-day trial that turns into a charge. Adding a password to a PDF is a few hundred lines of cryptography that any modern browser can run in a second or two. It doesn't need a contract.
Protect PDF is the whole tool, not a teaser for a paid tier. There's no Pro version. It works the same whether you're a freelancer sending an invoice, a parent sending a scanned passport, or someone at a very large company protecting one spreadsheet export on a Friday afternoon. And 10% of every dollar Microapp earns goes to charity, off the top, audited quarterly.
Check it yourself. Open your browser's developer tools on the Network tab, then protect a file. No request carries your PDF or your password. Or load the page, turn off Wi-Fi, and protect a file anyway. It still works.
Common mistakes when protecting a PDF
Sending the password with the file. A protected PDF and its password in the same email is one stolen inbox away from a readable PDF. Send the file by email and the password by text message or a phone call. Different channel, every time.
Losing the password. There's no recovery key, no reset email and no back door, and we never see your password. If it's gone, the file is gone. Keep your unprotected original somewhere safe, and save the password before you send anything.
Protecting a file that's already protected. The tool refuses and points you to Unlock PDF. It won't wrap a second lock around the first. To change a password, remove the old one there, then bring the copy back here.
Doing the other jobs afterwards. Once a PDF is encrypted, other tools can't read inside it. That includes ours. So do everything else first: black out anything sensitive with Redact PDF, stamp a CONFIDENTIAL mark with Watermark PDF, join files with PDF Merger, shrink scans with Compress PDF. Protect last.
Trusting a password over redaction. A password protects the file from people who don't have it. It does nothing about the people you give it to. If a page holds something the recipient shouldn't see, redact it before you protect the file.
Frequently asked questions
How do I email a password-protected PDF?
Attach the protected file to an email like any other attachment. Then send the password somewhere else: a text message, a call, a messaging app. Most email systems can't scan inside an encrypted PDF, so some corporate filters hold it for review. If it doesn't arrive, ask the recipient to check quarantine before you try again.
Does password protection make the PDF larger?
Slightly. Each encrypted stream and string gains 17 to 32 bytes, for a random starting block plus padding. A typical document grows by a few kilobytes. Nothing is re-drawn or re-compressed, so it stays close to the original's size. Tools that turn each page into an image can't say the same. If size matters, run Compress PDF before protecting, not after.
Can I password protect a PDF on my phone?
Yes. It's a web page, so it runs in your phone's browser the same way it runs on a laptop. Tap the box, pick the PDF from your files, type the password twice, and save the download. Nothing to install, and the file still never leaves the phone.
Can someone remove the password without knowing it?
Not by any practical method, if the password is a good one. Removing an open password takes the password. That's why Unlock PDF asks for it. The only route in without it is guessing, and that's why length matters so much. A random 12-character password is out of reach. A pet's name plus a year isn't.
Should I use the same password for every PDF I send?
Better not. Once one recipient knows it, they can open every file you've ever protected with it, including ones meant for someone else. Give each recipient, or each batch of documents, its own password. A generator and a password manager make that painless.
Is a password-protected PDF the same as a redacted one?
No, and mixing them up is a common and costly mistake. Protection hides the whole file from people without the password. Redaction permanently removes chosen content from the file for everyone. Anyone who has the password sees everything that isn't redacted. If a page holds a detail the recipient shouldn't see, redact it first, then protect the result.