Protect PDF

A PDF password is two different things wearing the same word, and almost every misunderstanding about PDF security comes from the confusion. The first is the user password, sometimes called the open password: without it the file cannot be opened at all. The second is the owner password, sometimes called the permissions password: the file opens for anyone, but the restrictions it carries — no printing, no copying, no editing — are enforced by the software that reads it. They can be set together, and they behave very differently.

Encryption is not the same as a restriction

Encryption is mathematics. With a user password, the content of the file is scrambled with a key derived from that password, and without the password there is nothing to read: not the text, not the images, not the page layout. With an owner password only, the content is still scrambled, but the key needed to unscramble it is stored inside the file in an obfuscated form so that any reader can open it while still obeying the permission flags. That is why a "restricted" PDF can be opened by everyone and copied by anyone with a tool that ignores the flags.

This is worth stating plainly, because the industry sells restriction as protection. It is a request, not a wall. A user password is the wall. If a document must not reach the wrong person, the only reliable control is an open password, delivered separately from the file, plus the knowledge that the recipient can print to paper or photograph the screen once it is open.

What AES-256 actually means

The version of the standard matters. Older PDFs use RC4, a stream cipher from the late 1980s that is now considered broken, followed by AES-128, which is fine but older. The current standard is AES-256 with revision 6, and it is what this page writes: keys generated by the browser's cryptographic random source, per-file salts, and no password stored anywhere in the file. A PDF with AES-256 and a long open password is genuinely hard to attack; a PDF with RC4 and a four-character password is a formality.

Password length therefore matters more than cipher choice. Eight random characters is the practical minimum; a short phrase of four unrelated words is both stronger and easier to type. The password you can remember and nobody can guess is the whole target.

The password you will lose

Before encrypting anything, answer one question: where will this password live in six months? An encrypted file with a forgotten password is a file you no longer own, because no legitimate service can recover it — not this page, not the software that made it, not the company that wrote the PDF specification. The mathematics that protects the document is the same mathematics that makes recovery impossible.

Write the password in a password manager before you press the button, and keep the unencrypted original until the encrypted copy has been opened successfully once. That second habit costs nothing and prevents the most common support request on the internet.

What to protect, and what to leave alone

Open passwords belong on documents that travel: contracts to a client, payslips by email, medical letters, a passport scan sent to a landlord. They do not belong on a file you keep on your own disk, because your disk already has an encryption layer if you turned it on, and a second password on every file is how people end up unable to open their own archive.

Permission flags are useful in one narrow case: a draft you are sending to a colleague where printing from the shared printer is fine but editing the numbers is not. Even then, send the flags with a sentence in the email explaining what they mean; the person on the other end deserves to know why the file behaves the way it does.

Doing it on this page

The file is read and encrypted inside your browser. Nothing is uploaded, which means the password never leaves the device and cannot be logged by anyone, including this site. A fresh owner password is generated for each run so the restrictions can still be changed later by whoever owns the document, and the encrypted copy is downloaded immediately. Close the tab afterwards and the decrypted content is gone from memory.

One last habit worth building: name the protected file with the fact that it is protected, and send the password by a different channel than the file. A password in the same email as the attachment is not a second lock, it is the same lock with the key taped to it.