PDF Password
Protect PDFs with AES-256 encryption or unlock files you own — fully local.
100% Private
Drop PDF files here
or click to browse · multiple supported
Encrypted in your browser using AES-128 · Files never leave your device
How this compares
Most online PDF locks ask you to upload a sensitive document to a server you don't control — a strange ask for a tool whose entire job is privacy. This one runs the AES-256 encryption in your browser using the Web Crypto API.
| Feature | WebToolVerse | Smallpdf | ILovePDF | Adobe Web | PDF24 |
|---|---|---|---|---|---|
| Files leave your device | Never | Upload | Upload | Upload | Upload |
| Encryption strength | AES-256 | AES-128 | AES-128 | AES-256 | AES-128 |
| Free file size | Browser memory | 5 MB | 25 MB | 100 MB | Unlimited |
| Login required | After 1 task | ||||
| Decrypt (remove password) | |||||
| Permission controls (print/copy/edit/forms) | |||||
| Permission presets | |||||
| Owner-password layer | |||||
| Strength meter while typing | |||||
| Watermark on output | None | None | None | None | None |
Free-tier features as of May 2026. Competitor feature sets change often; check their sites for the most current limits.
Next steps
Runs entirely in your browser. No uploads. Your files stay private.
How PDF Password Protection Works — AES-256, Open Passwords, and Permissions
PDF Password adds or removes encryption on a PDF using @cantoo/pdf-lib, a fork of pdf-lib that supports the PDF encryption sub-spec. Encryption uses AES-256 (the algorithm published in PDF 2.0 / ISO 32000-2), which is the same standard banks, government agencies, and Acrobat Pro use. The crypto runs entirely in your browser via the Web Crypto API; the file never leaves the tab.
PDF supports two distinct passwords: an open password (also called the user password), which is required just to view the document, and an owner password, which controls editing, printing, copy-paste, and annotation. Setting only the owner password gives you a PDF that anyone can open but only you can modify. Setting both gives full access control. The two passwords can be different — that is the recommended setup for distributing read-only documents.
Permission flags let you allow or deny specific actions: high-quality printing, low-quality printing, modifying contents, copying text, adding annotations, filling forms, accessibility extraction, and assembly (page reorder). Most PDF readers honor these flags, though command-line tools like qpdf can strip them given the owner password — so permissions deter casual users but are not a hard security guarantee.
Removing a password requires knowing it. There is no recovery feature: if you have lost the password, this tool cannot brute-force or bypass it. That is by design — the AES-256 keyspace is far too large to attack in a browser, and a tool that did this would be a liability rather than a feature.
Once decrypted, the unlocked PDF is a normal file you can pass through any other tool — PDF Merger, PDF Compressor, PDF Editor, etc. After your downstream edits, return here to re-encrypt with a new password if needed.
Existing digital signatures are preserved by encryption (signing happens before encryption in the PDF spec). However, modifying the file after encryption — even fixing metadata — invalidates signatures, so apply password protection as the very last step in your workflow.
Browser memory is the practical limit. PDFs up to ~200 MB encrypt and decrypt comfortably on a modern laptop; the AES operation itself is fast (Web Crypto runs natively), but loading and re-serializing very large documents through pdf-lib is the bottleneck.
Common Use Cases
01
Email confidential contracts
Encrypt a contract or NDA before attaching it to email so a forwarded copy is unreadable without the password you share separately.
02
Client deliverables with print/edit limits
Allow viewing but block copy-paste, editing, and high-resolution printing on client-facing proposals or design proofs.
03
Remove forgotten owner restrictions
Strip permission flags from your own PDFs once a project is complete and the file is moving into general circulation.
04
Compliance with GDPR or HIPAA workflows
Apply at-rest encryption to PDFs containing personal or medical data before storing them on shared drives or sending to third parties.
Frequently Asked Questions
AES-256, the strongest algorithm in the PDF specification (ISO 32000-2). This is the same standard used by Acrobat Pro's default encryption setting and is widely accepted by enterprise document policies.
The user (open) password is required to view the PDF. The owner password controls editing, printing, copying, and annotation. Set both for full access control, or just the owner password for a viewable but restricted document.
Yes. Printing, content modification, copy-paste, annotations, form filling, accessibility extraction, and page assembly are all separately togglable. Acrobat Reader and most other PDF tools honor these flags.
Major PDF readers honor them, but command-line tools like qpdf can strip permissions given the owner password. Permissions deter casual misuse but are not a hard cryptographic guarantee — only the open password protects content from anyone without it.
No. AES-256 cannot be brute-forced in a browser, and password recovery is not implemented by design. If the password is lost, the document cannot be opened by this tool or any other.
No. Encryption wraps the existing content streams without changing them; form fields, annotations, and embedded files all remain functional once the file is opened with the password.
No — but modifying the file after encryption does. Apply password protection as the last step in your workflow, after any signing, flattening, or metadata cleanup.
No. Both AES-256 (via Web Crypto API) and PDF re-serialization (via @cantoo/pdf-lib) run inside your browser. The document stays in tab memory and is never transmitted.
Yes. Multiple files can be queued; each is encrypted with the same password and downloaded individually or as a single ZIP packed with JSZip.
Aim for at least 12 random characters mixing letters, digits, and symbols. AES-256 is unbreakable in practice, so the weak point is always the password itself — short or dictionary passwords are vulnerable to offline guessing if a copy of the file leaks.
Step-by-step guide
How to protect a PDF with a password
Walk through every step with screenshots, format-specific tips, and the platform-by-platform limits you need to know.
Advertisement