How to password-protect a PDF

Contracts, payslips, tax returns, medical results, passport scans: some PDFs should not open for whoever happens to find them in an inbox, a shared drive or a lost laptop. PDF has strong encryption built into the format, and using it takes a minute. The hard part is not the encryption but everything around it: choosing a password, getting it to the recipient, and doing things in the right order.

What a PDF password actually does

The format has two passwords, and only one of them is real protection.

• The open password (user password) encrypts the content. Without it, the pages are unreadable noise. This is what you want for anything sensitive.
• The owner password (permissions password) controls flags such as "no printing" or "no copying" for people who can already open the file. Readers are expected to respect these flags, but nothing forces them to. Treat them as a polite request, not security.

So the question to ask is simple: should this file be unreadable without a secret? If yes, you need an open password.

Built-in ways, and when they are enough

• Word on Windows or Mac: when saving as PDF, the options include encrypting the document with a password. Fine for a document you wrote yourself.
• Preview on a Mac: the Export dialog can encrypt the PDF with a password.
• Windows itself: the built-in "Microsoft Print to PDF" printer cannot add a password.
• iPhone and Android: there is no general-purpose way in the stock apps to encrypt an arbitrary PDF you received.

If the PDF comes from somewhere else, such as a scan, a bank download or a merged file, or you are on Windows or a phone, a dedicated tool is the practical route.

Add a password in the browser

Protect PDF runs qpdf, a long-established open-source PDF toolkit, inside your browser. On this path neither the file nor the password leaves your device.

1. Type the open password. The drop zone appears only once a password is entered.
2. Optionally type an owner password. It becomes the file's master password, which editors ask for before changing security settings. Leave it empty and the open password fills both roles.
3. Drop one or more PDFs. Each gets the same password and is saved with -protected added to its name.

The encryption is AES-256, the strongest method the PDF standard defines. Every current reader on desktop and mobile opens such files. The rare exceptions are very old software: outdated document systems or printers that print PDFs directly from a USB stick.

The tool does not switch off printing or copying. Anyone with the open password can use the document normally, which is usually what you want for a contract or a payslip. Files up to 100 MB are handled in the browser; for larger ones the page offers server processing, where the file and password are sent for that one job and deleted about an hour later.

Choose a password that holds

AES-256 will not be the weak point. Someone who gets the file can try passwords offline as fast as their hardware allows, with no lockout after failed attempts. The password alone decides how long the file stays private.

• A word, a name or a date of birth falls to dictionary and date lists quickly.
• Eight random lowercase letters are within reach of a determined attacker.
• Four or five random words, or 14 or more random mixed characters, put the file out of practical reach.

Password generator makes suitable passwords in the browser. For something you will read out over the phone, a few random words are easier to transmit than a string of symbols.

Send the file and the password separately

A password in the same email as the attachment protects nothing: whoever reads the email has both. Use two channels.

• PDF by email, password by text message or phone call.
• PDF through a file link, password in a messenger.
• For recurring exchanges, such as monthly payslips, agree a password once in person and reuse it for that recipient only.

Do not put a hint in the file name or the email subject. "Password is your birthday" makes the file as weak as a birthday.

Order of operations

Encrypted files cannot be edited by most tools without the password, including the ones on this site. Do everything else first and protect last:

1. Merge, reorder or delete pages.
2. Add a watermark, page numbers or a signature.
3. Compress the file if it must fit an email limit. Compress PDF cannot read an encrypted file.
4. Protect it.

If the PDF carries a digital certificate signature, for example a contract signed through an e-signature service, encrypting rewrites the file and breaks that signature's integrity check. Send such documents as they are, through the service that signed them.

Add traceability with a watermark

A password stops strangers. It does nothing once the intended recipient has opened the file and forwards it on. A visible watermark such as "Copy for Anna Kovalenko, rental application, Oct 2026" makes any leaked copy traceable and much less useful for reuse, which is why it is common practice for passport and ID copies.

Watermark PDF stamps that text across every page; then protect the watermarked file.

Remove a password from your own copy

Typing a password every time you open a statement gets old, and many tools refuse encrypted files. Unlock PDF makes an unencrypted copy of a file whose password you know.

• The file asks for a password before showing anything: type that password, then drop the file.
• The file opens but printing or copying is greyed out: leave the field empty and drop the file. Owner-only restrictions are removed without a password.

Each file is processed the moment it is added, using whatever is in the password field at that moment. For a year of statements from one bank, type the password once and drop them all. For files with different passwords, change the field between files.

Unlock PDF cannot recover a password you do not know. If it is lost, the file stays locked; that is the point of encryption.

Troubleshooting

• The recipient cannot open the file. Check for a trailing space or line break when the password was copied, keyboard language, and case. Very old reader software may not support AES-256.
• The unlock tool says the password is wrong. Bank passwords are often built from parts, such as name initials plus a birth date. Check whether the date format is DDMMYYYY or DDMMYY. Remove the failed entry, correct the password and add the file again.
• Merging or compressing fails. One of the files is still encrypted. Unlock it first, finish the edits, then protect the result again.
• The signature shows as invalid. The file was encrypted after being digitally signed. Use the original signed copy.

Checklist

1. Finish all edits, compression and watermarking first.
2. Generate a long password: four or more random words, or 14+ characters.
3. Protect the PDF and test-open it yourself.
4. Send the password through a different channel than the file.
5. Store the password somewhere safe; there is no recovery.
6. Keep an unprotected original in secure storage for future edits.