About PDF Password Protect
Adding a password keeps out anyone who comes across the file by accident: someone browsing a shared folder, a person who receives a misdirected email, or the next user of a work laptop. For that job, it works well, and your file and password stay on your own device while it happens.
You should know what it is not. This tool uses RC4 128-bit encryption, an old method from the PDF standard. Every reader can open it, which is why it is used here, but it is no longer considered strong. PDF 2.0 (ISO 32000-2) deprecates it in favour of AES-256. For legal, medical or financial documents that must resist a determined attacker, use AES-256 in software such as Adobe Acrobat.
How it works
The tool writes what the PDF specification calls the Standard security handler at version 2, revision 3, with a 128-bit key: the output's encryption dictionary reads /Filter /Standard /V 2 /R 3 /Length 128. A key is derived from your password using MD5, then every stream and every text string in the file is encrypted with RC4 under a key made per object. Page content, images, the title and the author are all scrambled. Page count and page size are not, because they belong to the file's structure. Our PDF Metadata Viewer showed both on a locked file with no password given.
Passwords are limited to 32 plain English letters, digits and symbols, because this format only uses the first 32 bytes, and readers disagree on how to handle anything else. If you leave the owner password empty, a random one is generated and thrown away, so any restrictions can never be lifted, even by you. Before offering the download, the tool opens its own output: it must refuse to open with no password, and must open with yours. Restrictions only leaves the file readable by anyone, and sets flags asking readers not to print, copy or change it. Mainstream readers honour those flags, but they are a request, and software exists that ignores them.
How to use PDF Password Protect
- Press Select PDF file and choose the document to lock, or drop it here.
- Under What should the password do?, choose Required to open or Restrictions only.
- Fill in Password to open the file and Type it again. Open Printing, copying and owner password for an owner password and the four Allow boxes.
- Press Protect PDF (it reads Apply restrictions in that mode), then download the file.
A real run, checked with independent software
plans.pdf, 3 pages, 2.2 KB
Required to open, password hunter2-longChecked: the new file refuses to open without the password, and opens with it.
plans-protected.pdf, 4.1 KB
pdfinfo with the password:
Encrypted: yes (print:yes copy:yes change:yes addNotes:yes algorithm:RC4)
Pages: 3The file grew because this format has to be saved without object streams. pdf.js and poppler both refused it without the password and read the text with it. The document title was no longer readable in the raw bytes.
When it helps
- Emailing a document to someone and sending the password by a different route
- Keeping casual eyes off a file on a shared drive or a family computer
- Asking readers not to print or copy a draft, using Restrictions only
Tips for a better result
- Use a long password, because length matters most for RC4. A random string of 20 or more characters is far harder to break than a short word. The Password Generator can make one.
- Send the password separately from the file. A password in the same email protects nothing.
- Keep an unprotected copy somewhere safe. Nobody can recover a lost password for you, and that includes this site, because it never sees it.
- Set an owner password if you may want to change the restrictions later. It must differ from the open password.
Good to know
- It uses RC4 128-bit, not AES. RC4 is no longer considered strong, and a short password can be broken with the right software. AES-256 is not available here.
- Page count and page sizes remain visible without the password.
- Characters outside plain English letters, digits and symbols are refused, as are passwords over 32 characters.
- Printing and copying limits rely on the reader's cooperation.
- A file that is already protected must be unlocked first. Protected files cannot go through the other PDF tools here until then.
Questions people ask
How secure is this?
Enough to keep out people without the password and without intent, and not enough for serious secrets. RC4 is a dated cipher and the format allows fast guessing, so a short password can fall to widely available software. Use AES-256 in dedicated software for sensitive files.
Why not use AES-256 here?
The PDF library in this browser tool does not write AES, so the encryption is implemented here from the older part of the specification. RC4 also opens in every reader, including very old ones. If you need AES, Adobe Acrobat and similar software offer it.
What if I forget the password?
There is no recovery here. The password is not stored or sent anywhere, and the PDF Unlock Helper needs you to know it. Keep the original file safe.
What to use next
- PDF Unlock Helper: to remove the password later, when you know it
- Password Generator: to make a long password that is hard to guess
- PDF Metadata Viewer: to see what a protected file still reveals
Learn more
Last reviewed . Read our editorial policy.