How to Password-Protect a PDF (Free, Without Uploading It)

Adding a password to a PDF takes a minute, but three details decide whether it actually protects you: which kind of password you set, how strong the encryption is, and whether your document ever leaves your computer.

Why bother password-protecting a PDF?

PDFs are easy to copy, forward and forget about. A file attached to an email passes through several mail servers, lands in the recipient's inbox, is synced to their phone, and is often swept into a cloud backup. Once it is out, you no longer control who reads it. Documents worth locking include:

• Invoices and receipts — bank details, tax IDs and pricing.
• Contracts and NDAs — client names, commercial terms, signatures.
• Identity documents — passport, driving licence and national ID scans are the raw material of identity theft.
• Payslips and HR records — salary, home address, national insurance or social security numbers.
• Medical and insurance paperwork — diagnoses, prescriptions, claim references.

A password turns "anyone who gets a copy can read it" into "anyone who gets a copy must also know the password", and switching off printing and copying makes a forwarded copy far less useful.

What AES-256 means, and why old RC4 encryption is not good enough

Encrypting a PDF transforms its contents with a key derived from your password. The format allows several algorithms, and they are not equivalent:

• RC4, 40-bit — a 1990s design with about 1.1 trillion possible keys (2⁴⁰), which modern hardware can work through in a practical timeframe.
• RC4, 128-bit — old and deprecated; RC4 has known statistical weaknesses.
• AES-128 — solid and widely used.
• AES-256 — the current standard: a 256-bit key, about 1.16 × 10⁷⁷ possibilities.

One caveat matters here: encryption is only as strong as your password. AES-256 with the password "1234" is a ten-thousand-combination problem, and every one of them can be tried in a blink. The algorithm protects the file if it is stolen; the password decides how long that protection lasts.

Two different locks: an open password vs permission restrictions

These are separate features with separate jobs, and mixing them up is the most common reason people are disappointed by "protected" PDFs.

Open password (encryption)

The document is encrypted, and anyone opening it sees a password prompt. Without the password the pages cannot be rendered at all. Use this when confidentiality is the point: identity scans, payslips, medical records, unreleased contracts. If the file is intercepted, it is unreadable.

Permission restrictions (no open password)

The file opens normally — no password prompt — but the PDF reader is instructed not to allow printing, copying text and images, editing, or commenting. This is a "please do not" lock rather than a "you cannot" lock: it stops accidents and casual reuse, and it is the right choice for a price list, a policy document or a spec you are happy for people to read but not to retype or print. Because the content itself is not encrypted, such restrictions can be removed by anyone with a PDF tool — see our guide to removing PDF restrictions.

You can apply both at once: an open password plus restrictions. That is the strongest combination, and it is the one to use when a document is both confidential and not meant to be printed or edited.

Step by step: protecting a PDF in your browser

1. Open the Protect PDF tool.
2. Drag your PDF onto the drop area, or click Select file. Files up to 100 MB are accepted.
3. In the Password to open the PDF field, type the password and confirm it. Leave the field empty if you only want permission restrictions.
4. Under What others are allowed to do, uncheck anything you want to forbid: printing, copying text and images, editing, and comments or form filling.
5. Optionally set an owner password — separate from the open password, and what you will need later to change the restrictions (useful when you hand someone a read-only copy but want to re-enable printing yourself).
6. Click Protect PDF. The encryption runs in your browser tab.
7. Download the protected file. Text and layout are untouched; only the security settings changed.

Weak passwords vs strong passwords

Avoid:

• Four-digit PINs, birthdays, house numbers, children's names.
• Single dictionary words with a capital letter and a trailing digit ("Invoice2026" is a guessable pattern).
• Anything reused from another account or document.

Use:

• 12 characters or more. A random passphrase of four dictionary words drawn from a 20,000-word list gives roughly 20,000⁴ = 1.6 × 10¹⁷ combinations — far beyond a four-digit PIN's 10,000.
• Mixed character classes if you prefer a password to a passphrase: upper case, lower case, digits and symbols.
• Unique per document, stored in a password manager.

Warning: a lost password cannot be recovered

Doing it on your phone

The tool is an ordinary web page, so it works in mobile Safari and Chrome with no app to install.

• iPhone / iPad: save the incoming PDF to Files, open securepdfnow.com/protect-pdf in Safari, tap Select file, then Browse to pick the PDF from On My iPhone or iCloud Drive. The protected file lands in Files → Downloads.
• Android: open the page in Chrome, tap Select file, and choose the PDF from Downloads or Drive.
• Typing tip: symbol-heavy passwords are painful on a phone keyboard. A four-word passphrase is easier to type accurately and still strong; transfer anything generated on a computer through your password manager, not a chat message.
• Remember the device: a PDF in a messaging app's cache is readable by anyone holding your unlocked phone, whatever its password. Keep the screen lock on and clear the file when you are done.

Keep reading

• How to remove a PDF password or its print/copy restrictions
• Why uploading a PDF to an online tool is a privacy risk
• All PDF guides