How PDF password protection works
When you protect a PDF, the tool scrambles its content with AES-256 encryption and records a key derived from your password. Text, images and fonts are unreadable until someone supplies the password; a PDF reader then rebuilds the key and decrypts the pages on the fly. This is the same method Adobe Acrobat uses for its highest security setting, and it is defined in the international PDF standard (ISO 32000-2).
The encryption runs inside your browser. Neither the file nor your password is uploaded, which matters because the password is exactly what should stay secret.
Two kinds of password
| Open password | Permissions password | |
|---|---|---|
| What it does | Needed to open and read the file | Needed to change the restrictions |
| Protects against | Anyone without the password | Printing, copying or editing by people who can open it |
| How strong | Real encryption: unreadable without it | Depends on the reader obeying the rules |
The open password is the real lock. Restrictions are a polite request: Adobe Reader, Chrome, Edge and most readers honour them, but some apps and tools ignore them. Use restrictions to discourage casual copying, not to protect secrets.
If you turn restrictions on and leave the permissions password empty, the tool creates a long random one. Nobody will be able to lift the restrictions on that copy, so keep your original file if you might need to print it later.
Choosing a strong password
A password’s strength comes mostly from its length. Each extra character multiplies the number of guesses an attacker needs.
For example, 8 lowercase letters give 26⁸ ≈ 209 billion combinations, which a computer can try quickly against a stolen file. Twelve characters mixing upper and lower case, digits and symbols give about 94¹² ≈ 4.8 × 10²³, which is far out of reach. A phrase of four random words, such as river lamp orbit gravy, is long, strong and easy to type.
The strength meter under the password box follows the same idea: it rewards length and variety, and it marks common passwords and simple patterns as weak whatever their length.
Worked example
You need to email a scanned passport and a bank statement to a visa agent.
- Choose the PDF and type a passphrase such as
Blue-Tiger-Harbour-71in both boxes. The meter shows Very strong. - Leave restrictions off, since the agent needs to print the file.
- Click Protect PDF and download
documents-protected.pdf. - Open the download to check: your PDF reader asks for the password.
- Email the PDF, then send the password a different way, for example by text message or phone call. Sending both in the same email defeats the purpose.
Tips
- Need a strong password quickly? Create one with the Password Generator.
- Compress or edit first. A protected PDF cannot be changed by other tools without the password, so run Compress PDF or Watermark PDF before protecting it.
- Changing a password. Remove the old one with Unlock PDF (you need to know it), then protect the file again with the new one.
- Very old readers. AES-256 needs a PDF reader from about 2010 or later. Every current browser and phone supports it.