Add a password to a PDF with AES-256 encryption, and optionally restrict printing, copying and editing - all in your browser.
Adds a password to a PDF so it asks for that password before anyone can open it, using real AES-256 encryption (the PDF 2.0 standard security handler) rather than a flag a reader is merely asked to respect. Everything happens in your browser: the PDF is read, encrypted, and handed back as a download without being uploaded anywhere, so the unprotected file never sits on a third party's server. You can also restrict printing, copying, and editing for people who do open it.
No. The file is read and encrypted by your own browser using its built-in cryptography, and the protected copy is produced locally for you to download. Your PDF is never sent to a server, so the unprotected original never leaves your device. (The page does fetch the open-source pdf-lib library from a CDN to read and write the PDF structure, but that request contains none of your data.)
It uses AES-256, the strongest encryption the PDF standard offers (PDF 2.0, security handler revision 6), with a key derived from your password through the standard's hardened SHA-2 based hash. In practice the weak point is the password rather than the cipher: a short or common password can be guessed regardless of the cipher, so use a long, unique one.
The file cannot be recovered. A password is the only thing that unlocks the contents, and because the work happens in your browser we never see it and cannot reset it. Store the password in a password manager, and keep an unprotected original somewhere safe if you might need to get back in.
It sets permission flags that PDF readers are expected to respect: with printing off, a compliant reader greys out Print; with copying off, it blocks selecting and copying text and images; with editing off, it blocks changes, form filling, annotations, and page rearranging. These are a courtesy enforced by the reader, not a lock - the password is what really protects the contents, and some tools ignore the flags. Screen readers remain allowed regardless, so the document stays accessible.
The password people enter to open the file only gives them the permissions you left ticked. An owner password opens the same file with every permission regardless of the restrictions, which lets you keep full control of a restricted document. If you restrict something and leave the owner password blank, a random one is generated and discarded, so nobody has that extra access.
AES-256 has been part of the PDF standard for years and current versions of the major readers support it. Very old software (roughly from before 2010) and some legacy print or archive systems may not, and this tool does not offer the older, weaker RC4 or AES-128 formats. Test with the app your recipient will actually use if that matters.
A PDF that is already protected has to be unprotected first; this tool will tell you rather than stack a second layer. Note that the Unlock PDF tool only removes restrictions from PDFs that open without a password and does not yet handle AES-256, so it cannot remove a password you set here. To remove one, open the file in a reader with the password and save or print it to a new, unprotected PDF.
Strict PDF readers normalize passwords with a standard (SASLprep) that rejects characters outside the Basic Multilingual Plane, such as emoji, so a file protected with one might refuse to open in those readers. Letters, numbers, accented and non-Latin characters, and ordinary symbols are all fine. Passwords are limited to 127 bytes by the PDF standard.
Encrypting a file changes its contents, which invalidates any digital signature it carried. Protect the document first and sign it afterwards if you need both.
← All tools · Blog · Cheat sheets · FAQ