The tool encrypts the file with 256-bit AES, the strongest cipher the PDF standard defines, which every reader since Acrobat 9 supports. Anyone opening it needs the password. There is no back door and no recovery, so save the password in a manager before you protect anything that matters.
The three permission toggles (print, copy, edit) are honoured by every mainstream reader, but they are flags inside the file, not locks. Treat them as etiquette for honest recipients and rely on the password for anything that must stay private.
Most people reach for a PDF password at the moment a document is about to leave their control: a tax return going to an accountant, medical records to a new clinic, a contract to a counterparty. Those are the right moments. The mistake is assuming all of the options on the screen give the same kind of protection. One of them does; the others are polite requests.
How to password protect a PDF
Add the PDF
Drop the file or browse for it. It is read into browser memory and stays there.
Choose a password and type it twice
The second box exists because encryption is unforgiving. A typo becomes a file nobody can open, including you.
Set the permissions
Decide whether someone who has opened the file may print it, copy text out of it, or edit it. Form filling and screen-reader access stay on regardless.
Press Protect PDF and download
The encryption key is derived from your password inside the browser and the file is rewritten with AES. Store the password somewhere safe before you send the file anywhere.
What the encryption actually protects
A protected PDF stores every content stream, image and font encrypted with a key derived from your password. A reader that does not have the password can see that pages exist and how many, and nothing else. The text is not hidden behind a prompt; it is mathematically unreadable without the key.
The strongest cipher in the PDF standard, opened by every reader since Acrobat 9. The same cipher family banks and phones use.
No master key, no reset email. Forgotten means gone. That is the point, and the risk.
The key is derived in the browser. PDFslime never sees the password or the file.
AES is not what fails when a protected PDF is opened by someone who should not have it. The password is. Cracking software does not attack the cipher; it tries passwords, millions per second on a graphics card, starting with the ones people actually use. A short or predictable password turns strong encryption into a formality.
Picking a password worth using
Length beats cleverness. Each extra character multiplies the work an attacker faces, while substituting a 3 for an E adds almost nothing because cracking dictionaries already try it. A four-word phrase you can remember outlasts eight random symbols you have to write on a sticky note.
- Never reuse a password from an account. If that account is breached, its password is in every cracking list within days, and your PDF opens with it.
- Save it before you protect the file. A password manager entry takes ten seconds. Re-creating a lost document takes considerably longer.
- Send it by a different channel. A protected file and its password in the same email is a locked box with the key taped to the lid. Text or call the password, email the file.
What the permission toggles really do
PDF encryption carries a set of permission flags alongside the password. Turning off printing greys out the print button in Acrobat, Preview and Chrome. Turning off copying blocks text selection. Turning off editing stops changes in a PDF editor. Every mainstream reader honours them, which makes them genuinely useful for setting expectations with a cooperative recipient.
- Allow printing offPrint button disabled
- Allow copying offSelection and clipboard blocked
- Allow editing offEditors refuse changes
- Form fillingAlways allowed
- Screen readersAlways allowed
- A photo of the screenNot preventable
When a password is the right tool, and when it is not
The file travels through channels you do not control
- Email to an accountant, lawyer, clinic or lender
- Cloud drives and shared folders with broad access
- Portals and ticketing systems that keep attachments for years
- Anything containing account numbers, ID documents or health data
It adds friction without protection
- The file lives only on an already-encrypted laptop or phone
- It is going into a signing service that must read it (sign first, then protect)
- The recipient must edit it, and editing is the point
- Public documents where the goal is a visible mark: use a watermark
Two combinations are worth knowing. For a file sent over an end-to-end encrypted messenger, the messenger protects it in transit and the PDF password protects it at rest on the other phone; together they cover both halves. For a document that needs sensitive lines removed rather than hidden, redaction is the tool, because a password protects the whole file or nothing.
Why encrypting on a server is the wrong trust model
Uploading a PDF and a password to a website means handing that site both the document and the key to it, at the same moment, in the same request. A well-run service deletes both afterwards. A breached, subpoenaed or misconfigured one does not. For a document sensitive enough to encrypt, that is the wrong bargain even when the service is honest.
The output is a standard encrypted PDF 1.7 file. It prompts for the password in Acrobat, Preview, every browser and every mobile reader, and it opens on any device once the password is typed. One caution: a few online services strip encryption during upload, so if a portal demands an unencrypted file, remove the password with the Unlock tool rather than hoping.
Adding a password to a file that already has one
The tool needs to read the pages in order to encrypt them, so it cannot re-encrypt a file that is already locked. Unlock it with the existing password first, then set the new one here. The same order applies to every other tool on this site: merge, split, compress and stamp on the unlocked copy, then protect the finished result as the last step.
The tool is right above
Everything on this page runs in your browser. Scroll up, drop the file, and keep it on your machine.
Common questions
Questions that come up at the moment of pressing Protect.
01What encryption does the tool use?
256-bit AES at revision 6, the version ISO 32000-2 defines and the one every current tool writes. Its password check runs Algorithm 2.B, sixty-four or more rounds of hashing per guess, which is what makes a stolen file expensive to attack rather than merely encrypted. Acrobat X and later, Preview, Chrome, Firefox, Edge and every current phone reader open it once the password is supplied; Acrobat 9 is too old for this revision. The password you choose is still the part that decides how strong the lock really is.
02Can the password be recovered if I forget it?
No. There is no master key and no reset. Cracking tools only work against weak passwords. Store the password in a password manager before you protect anything you cannot afford to lose.
03What is a good password for a PDF?
Long and memorable beats short and clever. A four-word passphrase with a number outlasts eight random symbols. Never reuse a password from an account, because breached account passwords are the first thing cracking software tries.
04Do the permission settings stop someone copying the document?
They stop cooperative software: the print button greys out, text cannot be selected, editors refuse changes. They do not stop someone with the password from using a tool that ignores the flags, or from photographing the screen. The password is the real protection.
05Can I protect a PDF that is already password-protected?
Remove the existing password with the Unlock tool first, then apply the new one here. The tool has to read the pages to encrypt them.
06Does protecting change the document?
Only the encryption wrapper. Pages, text, images, bookmarks and form fields are unchanged. Form filling and accessibility remain available even when copying and editing are turned off.
07Is my file or password sent anywhere?
No. The key is derived from your password inside the browser, the file is encrypted in memory, and the result is offered as a download. Nothing leaves your device.
08Is it free?
Free. Every tool, unlimited use, no signup.