Protect PDF with Password

Send a PDF Only the Right Person Can Open

Email is not a secure channel. A PDF attachment forwarded once is forwarded forever. Password protection changes this — even if a protected PDF ends up in the wrong inbox or gets forwarded without permission, it is unreadable without the password. Our free PDF password protection tool adds AES-128 encryption to any PDF you upload, requiring a password to open it in any PDF viewer on any device. Beyond access control, you can also set permission flags to block printing, copying or editing — giving you precise control over how recipients can use the document. All of this happens in your browser, so your file and passwords never touch a server.

The Two Passwords — What Each One Does

PDF encryption supports two separate password roles. The user password (open password) is the one your recipients need. Without it, the PDF is completely inaccessible — the content is encrypted and the viewer shows a password prompt on opening. This is the password you share with the people you want to be able to read the document. The owner password (permissions password) is a separate administrator credential that unlocks the ability to change the security settings themselves. A recipient with only the user password can read the document but cannot override the printing, copying or editing restrictions you set. If you leave the owner password field blank, our tool generates a strong random owner password automatically — ensuring nobody can silently strip your permissions. Keep this owner password recorded safely if you ever need to change the settings later.

Permissions — Controlling What Recipients Can Do

Beyond the open password, PDF encryption lets you set permission flags that compliant PDF viewers enforce. Three permissions are configurable here. Allow Printing: when disabled, all printing — including printing to PDF — is blocked. When enabled, high-resolution printing is permitted. Allow Copying Text: when disabled, text selection and clipboard copy operations are prevented in the viewer. When enabled, text can be selected and copied freely. Allow Editing Content: when disabled, page content cannot be modified — editing, inserting pages and adding annotations beyond form-filling are blocked. Form filling and accessibility content access remain enabled regardless of the editing restriction, as blocking these would prevent legitimate assistive technology use.

AES-128 Encryption — What the Standard Actually Means

AES-128 (Advanced Encryption Standard with a 128-bit key) is a symmetric block cipher used across banking, government and enterprise security. In PDF encryption, it is applied to every content stream in the document — all page content, embedded fonts and images are encrypted individually. The encryption key is derived from your password using a key derivation function defined in the PDF specification (ISO 32000). A 128-bit key means there are 2^128 possible key combinations — approximately 340 undecillion — making brute-force computationally infeasible with current or foreseeable hardware. The resulting protected PDF is compatible with Adobe Acrobat 5 and later, and opens correctly in every major PDF viewer.

Situations Where PDF Password Protection Makes Sense

• Confidential reports: Financial projections, salary data and strategic plans sent by email to specific individuals
• Legal contracts: Lock editing to prevent unauthorised modification of signed agreements — block copying to prevent selective quoting out of context
• Exam papers: Protect before distributing to invigilators — pair with our Watermark PDF tool to brand each recipient's copy with their name before encrypting
• Personal ID documents: Password-protect passport scans, bank statements and payslips before emailing to third parties like landlords, banks and employers
• Licensed reports: Block printing and copying of documents you are licensing for viewing only, not redistribution
• Invoice and payment records: Protect outgoing invoices against tampering before sending to clients

After Protecting — Removing It Later

If you later need to remove the password — to merge the file, compress it, or share it openly — use our Unlock PDF tool with the user password you set here. The unlock operation strips the encryption and permission flags, producing an unrestricted copy. Keep a record of the passwords you set — our tool never stores them, and without the correct password the encrypted PDF cannot be recovered.

Your Passwords Never Touch a Server

All encryption is computed locally in your browser using pdf-lib. Your PDF content, user password and owner password are never transmitted to ToollyX or any external service. The encrypted output streams directly to your downloads folder. This is essential for protecting confidential legal documents, financial records and personal identification materials — a server-side encryption service would necessarily receive and handle your sensitive content during the process; browser-based encryption eliminates that risk entirely.

✓Verified by ToollyX Team · Last updated June 2026