PDF Password

Protect PDFs with AES encryption or unlock files you own — fully local.

100% private

Add AES password encryption to any PDF, or strip a known password off one you own. Useful for sending sensitive scans — passports, tax forms, signed contracts — over channels you do not fully trust, or for unlocking PDFs you are allowed to read but find blocked by forgotten boilerplate restrictions. The encrypt and decrypt steps both run in-browser through pdf-lib's encryption module, which means the password you type is never transmitted anywhere. That is the whole point of having one.

Drop PDF files here

or click to browse · multiple supported

Set Password
Permissions

Encrypted in your browser with AES · Files never leave your device

How this compares

Most online PDF locks ask you to upload a sensitive document to a server you don't control — a strange ask for a tool whose entire job is privacy. This one runs AES encryption in your browser; the file is never uploaded.

FeatureWebToolVerseSmallpdfILovePDFAdobe WebPDF24
Files leave your deviceNeverUploadUploadUploadUpload
Encryption strengthAES-128/256AES-128AES-128AES-256AES-128
Free file sizeBrowser memory5 MB25 MB100 MBUnlimited
Login requiredAfter 1 task
Decrypt (remove password)
Permission controls (print/copy/edit/forms)
Permission presets
Owner-password layer
Strength meter while typing
Watermark on outputNoneNoneNoneNoneNone

Free-tier features as of May 2026. Competitor feature sets change often; check their sites for the most current limits.

Next steps

Merge PDFs

Merge multiple PDFs into a single file — drag, drop, done.

Compress PDF

Compress PDFs to a fraction of their size — perfect for email.

Split PDF

Pull out specific pages or split a PDF into separate files.

PDF to Images

Turn PDF pages into crisp PNG, JPEG, or WebP images.

View all tools →
Runs right inside your browser tab. No uploads. Your files stay private.

How PDF Password Protection Works — AES Encryption, Open Passwords, and Permissions

PDF Password adds or removes encryption on a PDF using @cantoo/pdf-lib, a fork of pdf-lib that supports the PDF encryption sub-spec. Encryption uses AES — AES-128 for most documents, and AES-256 (the cipher published in PDF 2.0 / ISO 32000-2) for files already at that version. It is the same AES standard banks, government agencies, and Acrobat use. The cipher runs locally on your device through the bundled crypto-js library; the file never leaves the tab.
PDF supports two distinct passwords: an open password (also called the user password), which is required just to view the document, and an owner password, which controls editing, printing, copy-paste, and annotation. Setting only the owner password gives you a PDF that anyone can open but only you can modify. Setting both gives full access control. The two passwords can be different — that is the recommended setup for distributing read-only documents.
Permission flags let you allow or deny specific actions: high-quality printing, low-quality printing, modifying contents, copying text, adding annotations, filling forms, accessibility extraction, and assembly (page reorder). Most PDF readers honor these flags, though command-line tools like qpdf can strip them given the owner password — so permissions deter casual users but are not a hard security guarantee.
Removing a password requires knowing it. There is no recovery feature: if you have lost the password, this tool cannot brute-force or bypass it. That is by design — the AES keyspace is far too large to attack in a browser, and a tool that did this would be a liability rather than a feature.
Once decrypted, the unlocked PDF is a normal file you can pass through any other tool — PDF Merger, PDF Compressor, PDF Editor, etc. After your downstream edits, return here to re-encrypt with a new password if needed.
Existing digital signatures are preserved by encryption (signing happens before encryption in the PDF spec). However, modifying the file after encryption — even fixing metadata — invalidates signatures, so apply password protection as the very last step in your workflow.
Browser memory is the practical limit. PDFs up to ~200 MB encrypt and decrypt comfortably on a modern laptop; the AES operation itself is fast, but loading and re-serializing very large documents through pdf-lib is the bottleneck.

Common Use Cases

01

Email confidential contracts

Encrypt a contract or NDA before attaching it to email so a forwarded copy is unreadable without the password you share separately.

02

Client deliverables with print/edit limits

Allow viewing but block copy-paste, editing, and high-resolution printing on client-facing proposals or design proofs.

03

Remove forgotten owner restrictions

Strip permission flags from your own PDFs once a project is complete and the file is moving into general circulation.

04

Compliance with GDPR or HIPAA workflows

Apply at-rest encryption to PDFs containing personal or medical data before storing them on shared drives or sending to third parties.

Frequently Asked Questions

AES. For most PDFs the tool applies AES-128; for files already at PDF 2.0 (ISO 32000-2) it applies AES-256. Both are standard PDF encryption ciphers, widely accepted by enterprise document policies and the same family Acrobat uses.
The user (open) password is required to view the PDF. The owner password controls editing, printing, copying, and annotation. Set both for full access control, or just the owner password for a viewable but restricted document.
Yes. Printing, content modification, copy-paste, annotations, form filling, accessibility extraction, and page assembly are all separately togglable. Acrobat Reader and most other PDF tools honor these flags.
Major PDF readers honor them, but command-line tools like qpdf can strip permissions given the owner password. Permissions deter casual misuse but are not a hard cryptographic guarantee — only the open password protects content from anyone without it.
No. AES cannot be brute-forced in a browser, and password recovery is not implemented by design. If the password is lost, the document cannot be opened by this tool or any other.
No. Encryption wraps the existing content streams without changing them; form fields, annotations, and embedded files all remain functional once the file is opened with the password.
No — but modifying the file after encryption does. Apply password protection as the last step in your workflow, after any signing, flattening, or metadata cleanup.
No. Both the AES encryption and the PDF re-serialization run inside your browser via @cantoo/pdf-lib. The document stays in tab memory and is never transmitted.
Yes. Multiple files can be queued; each is encrypted with the same password and downloaded individually or as a single ZIP packed with JSZip.
Aim for at least 12 random characters mixing letters, digits, and symbols. AES is unbreakable in practice, so the weak point is always the password itself — short or dictionary passwords are vulnerable to offline guessing if a copy of the file leaks.

Step-by-step guide

How to protect a PDF with a password

Walk through every step with screenshots, format-specific tips, and the platform-by-platform limits you need to know.

Maintained by the WebToolVerse teamLast updated Suggest an edit

Advertisement

What's next?
PDF Compressor
PDF Merger
PDF Watermark