Add a password to a PDF: enter it twice, lock, and save only after the file has been reopened and checked
Adding a password to a PDF means encrypting its content so that a viewer asks for a password before showing anything. This tool can also block what a reader may do after opening the file: printing, copying text, editing, and adding comments or filling in forms. The encryption is AES-256, in the form defined for PDF 2.0 (security handler revision 6).
After locking, the tool reopens the result right away. The [Save PDF] button becomes available only once it has confirmed that opening without a password asks for one and that opening with your password unlocks every page. For example, [Lock the sample PDF] locks a made-up 2-page payslip with a random 16-character password and shows page 1, redrawn from the locked file, under [With password]. The PDF you choose and the password you type are never sent to a server; everything happens in the browser you are using.
When a PDF deserves a password
- Sending a payslip or tax document by email: pay statements, tax forms and medical records contain data that should not be readable by whoever ends up with a misdirected message or an opened mailbox. A password on the file keeps the content closed even when the email itself is not.
- Keeping a file on a laptop or USB drive: a stick left in a pocket or a laptop left on a train carries every file on it. A locked PDF stays unreadable without the password.
- Sharing a contract or quote draft with one person: files posted in a chat or a shared folder travel further than expected. Only people you give the password to can open it.
- Stopping a handout from being printed or copied: for course material or notices that anyone may read but that you do not want printed in bulk or copied wholesale, use [Open to all · limits only]. The section 'An open password and blocked actions are different things' below explains how far that protection reaches.
- Storing a file in the cloud for a long time: if the account is breached or a sharing link leaks, the file still cannot be read without the password.
How to use it
- Drop the PDF on the workspace or click [Choose PDF]. If this is your first time, [Lock the sample PDF] shows the whole flow.
- Choose who can open it. The default is [Password required to open].
- Type the password in both boxes. If nothing comes to mind, click [Generate random], then [Copy] it and store it somewhere else.
- Click any action you want to block after opening. A clicked button switches to 'Blocked'.
- Click [Add password]. When the check lines are marked, edit the file name if needed and click [Save PDF]. The original file is not changed.
An open password and blocked actions are different things
A PDF can carry two kinds of password. The open password (user password) is the key to the content: without it, no program can read the file. Blocked actions are usage permissions written inside the PDF; a viewer reads those flags and disables its print or copy buttons. The permissions password (owner password), which could change those flags, is generated by this tool as a 256-bit random value and shown nowhere, so nobody can lift the blocks from the resulting file. To change the restrictions, lock the original again.
| Setting | Someone without the password | Where blocked actions are honored |
|---|---|---|
| Password required to open | Cannot open the content | After someone with the password opens it, in programs that follow the permission flags |
| Open to all · limits only | Can read the content | Only in programs that follow the permission flags. In programs that ignore them, printing and copying work immediately |
The qpdf manual explains that if either of the two passwords is left empty, the PDF can be opened without a password. [Open to all · limits only] is exactly the case where the open password is left empty. Whether a program honors the blocks also varies. For example, pdf.js, which powers the PDF viewer in Firefox, has its setting for following permission flags (enablePermissions) turned off by default. So treat blocked actions as a way to reduce accidental printing or wholesale copying, and use an open password if the content itself must be protected.
- Print: blocks printing. Bit 3 and the high-quality printing bit 12 of Table 22 are both cleared.
- Copy text & images: blocks selecting and copying text and images. Text reading by screen readers (bit 10) is not blocked in the PDF 2.0 method.
- Edit & rearrange pages: blocks editing the content and inserting, rotating or deleting pages (bits 4 and 11).
- Comments & forms: blocks adding comments and filling in form fields (bits 6 and 9). If recipients must fill in and return the form, leave this one allowed.
How to read the combinations ladder
No way to break AES-256 itself is known, so the realistic way into a locked PDF is to try passwords one after another. Unlike a login page, someone holding the file can try as many times as they like. That is why password strength is best measured by the number of guesses it would take.
The ladder shows how many combinations exist for the same length and the same kinds of characters as your password. Characters are counted as 26 lowercase letters, 26 uppercase letters, 10 digits, 33 symbols and spaces, and 11,172 Korean Hangul syllables; any other character is estimated at 1,000 per group. These figures assume every character was picked at random, so a password built from words, names or birthdays is guessed much faster in practice. If a password is digits only, repeats a character or follows neighboring keys, the reason appears under the ladder.
| Password shape | Combinations |
|---|---|
| 4 digits | 10,000 |
| Birth date, 6 digits (MMDDYY, 100 years) | 36,525 |
| 8 lowercase letters | about 2.1 × 10¹¹ |
| 8 lowercase letters and digits | about 2.8 × 10¹² |
| 4 Korean Hangul syllables (if random) | about 1.6 × 10¹⁶ |
| 10 letters (both cases) and digits | about 8.4 × 10¹⁷ |
| The random 16 characters this tool generates | about 1.2 × 10²⁴ |
The dotted line on the ladder is 10¹⁰. The password-strength estimator zxcvbn rates 10¹⁰ or more guesses as strong protection against an offline attack on a slow hash. A randomly chosen password is found, on average, after about half of its combinations, so stay comfortably above that line. [Generate random] builds 16 characters from 32 letters and digits, leaving out the easily confused l, o, 0 and 1, which gives exactly 32¹⁶ combinations, and it prints them in groups of four so they are easy to copy by hand on a phone.
What the password hides and what stays visible
The PDF standard (ISO 32000-1, 7.6.1) encrypts only strings and streams; other values such as integers and booleans describe the structure of the document and are not encrypted. Saved naively, structural facts written as numbers, such as the page count and page size, would stay readable without the password. This tool moves the objects holding the pages and the document info into an object stream, which is encrypted, so page sizes and the page list are hidden as well. After locking, it reopens the file to confirm they really were hidden, and any it could not hide is listed under what stays visible.
Some things remain. A stream has its content encrypted but not its header (length and type), so in the usual PDF with one content stream per page the page count can be estimated by counting them. The file name and file size are visible whatever the password. Images and attachments have their content encrypted, but the width and height in pixels, and the size, written in their headers remain. In the sample payslip, the fact that the company mark at the top of page 1 is 600 × 200 pixels can be read without the password. If the file name contains a person's name or a sensitive project, change it under File name to save before saving.
Sending a locked file
- File and password by different routes: attach the file to an email and give the password by text message or phone. A password in the same email means one leaked message hands over both.
- The recipient's software: according to the qpdf manual, the 256-bit method is the AES method of PDF 2.0 and needs PDF 1.7 extension level 8 or later. Old PDF programs and some messaging previews may not open such files, so ask the recipient to download the file and open it with a current PDF viewer or browser.
- If you blocked actions: when the recipient must sign or fill in the document and send it back, leave [Comments & forms] allowed.
- Several documents? Combine first: finish merging PDFs or keeping only the pages you need before adding the password. This tool and other PDF tools refuse PDFs that are already locked, so locking should be the last step.
Common mistakes
- Sending the original: the original stays as it is and a new file with -protected at the end of its name is created. Check the name before attaching.
- Writing the password in the same email: if the email goes astray, the file and password leave together.
- Relying on limits alone: without an open password, programs that ignore the restrictions print and copy right away.
- Using a birth date or phone number: a 6-digit date has only 36,525 possibilities, and anyone who knows the recipient guesses it faster still.
- Caps Lock or a different keyboard layout: with Caps Lock on, 'password' goes in as 'PASSWORD'; on a different layout (QWERTY, AZERTY, QWERTZ) some keys, especially symbols, sit in other places. This tool cannot see how the recipient will type it, so a password that is easy to read aloud and type on any keyboard avoids lockouts.
- Changing the settings after locking and saving at once: if you change the password or the blocked actions after locking, the result no longer matches the settings, so the save button is disabled. Click [Lock again with new settings].
Limits and cautions
- A forgotten password cannot be recovered. This tool does not store passwords and has no function to break them.
- Blocked actions work only when the viewer honors them. Taking a screenshot or photographing the screen cannot be stopped by any setting.
- PDFs that already have a password or restrictions, digitally signed PDFs and XFA form PDFs are not accepted.
- Encryption is not redaction. Remove from the document, before locking, anything that must not be visible even to people who know the password.
- One PDF at a time, up to 100 MB. A device with little memory can stop on smaller files, and this tool was tested in Chrome.
As of The standard, manual and library sources were checked on 2026-10-21.
Sources
- 01ISO 32000-1:2008 Document management — Portable document format (Adobe public copy)7.6.1 scope of encryption (strings and streams only; integers and booleans excluded), Table 22 permission bits (print, modify, copy, annotate, forms, assemble, high-quality print)
- 02qpdf manual — Running qpdf (encryption options)--bits=256 is the PDF 2.0 AES method and PDF 1.7 extension level 8; --print, --extract, --annotate, --form, --assemble, --modify-other; leaving either password empty lets the file open without a password. This tool locks with qpdf 12.2.0 built for the browser (Apache-2.0 license)
- 03pdf.js 3.11.174 — web/app_options.jsenablePermissions defaults to false (permission flags are not followed). The preview and the reopen check also use this engine (Apache-2.0 license)
- 04zxcvbn README — score thresholds10¹⁰ or more guesses = 'strong protection from offline slow-hash scenario'
Frequently asked questions
Are my PDF and password uploaded to a server?
No. The PDF you choose and the password you type are processed only in the browser you are using. Only the tool files needed to load the page are downloaded; the PDF content and the password are sent nowhere. Closing the page also discards your work.
Can I get the file back if I forget the password?
No. This tool does not store passwords, and content locked with AES-256 cannot be restored without the password. Decide where to keep the password before locking, and keep the unprotected original somewhere separate. With the original you can lock again with a new password.
Can anyone open the PDF while printing or copying is blocked?
Yes. Switch who can open it to [Open to all · limits only] and choose what to block. Without an open password, though, the content is effectively not encrypted, so programs that ignore the restrictions print and copy at once. The PDF viewer in Firefox (pdf.js) ignores them by default.
Is a birth date a good password?
It is long enough to be accepted, but a date such as MMDDYY has only 36,525 possibilities across 100 years, so anyone holding the file can try them all quickly. If your organization requires a birth date, follow that rule; for sensitive documents use a long random password such as the 16 characters the tool generates, and send it by a different route from the file.
Can I use accented or non-English characters in the password?
Yes. It must be at least 6 characters and at most 127 bytes in UTF-8, where characters outside basic English letters take 2 to 4 bytes each. A recipient on a phone or another keyboard layout may struggle to type them, so for a file sent to several people, lowercase English letters and digits are easiest.
Can I change the password of a PDF that already has one?
This tool does not accept PDFs that already have a password or restrictions. Remove them first, for example in the program that created the file, if you know the password, then lock the file again here with a new one. Copies you already sent keep their old password.
Why can't a digitally signed PDF be locked?
Adding a password saves the PDF again, and a digital signature verifies the file's bytes as they were when signed, so saving again breaks it. That is why PDFs with a signature value are refused, while PDFs with only empty, unsigned signature fields are accepted. If you need both, set the security options and the signing order together in your signing program.
The recipient says the PDF will not open.
Their program must be able to read AES-256 (PDF 2.0) encryption. Ask them to download the file rather than use a messaging preview, open it with a current PDF viewer or browser, and check the password's capitals and any spaces at the ends. This tool enables the save button only after reopening the locked file with its password and confirming every page.