What's the difference between user and owner password?

The user password is required to open the document. The owner password is required to modify it — edit, copy text, print, depending on which permissions are configured. Owner has full control, user has whatever restricted access you've allowed. Either can be set independently, or both can be used together for tiered access.

Can password-protected PDFs still be printed?

It's configurable. The owner can allow full printing, deny it entirely, or allow only low-resolution printing. Restricting print is common for documents you want viewable but not redistributable. That said, screen captures work regardless of the print setting, so the protection stops casual misuse rather than determined attackers.

What encryption strength should I use?

AES-256, which has been part of the spec since PDF 1.7 and is the modern default. AES-128 from PDF 1.6 is still strong but no reason to deliberately choose. Avoid the legacy 40-bit RC4 cipher entirely — it's been crackable for years. Most modern tools default to AES-256, but verify if security genuinely matters.

Can I remove password protection?

Yes, provided you know the password. The owner password lifts all restrictions; the user password lifts the opening requirement. Without the password, your only options are paid password-recovery services that aren't guaranteed to succeed and can be expensive.

How should I share the password?

Through a different channel than the PDF itself. Email the file and text the password; send the file in Slack and read the password aloud over the phone; share the file by link and hand the password over in person. Sending both through the same channel means anyone who intercepts the message gets both, which defeats the protection entirely.

Will recipients need special software?

No. Every standard PDF reader — Adobe Reader, macOS Preview, the built-in viewers in Chrome and Firefox — handles password-protected files natively. Recipients just see a password prompt when they open the document and enter what you sent them.

Is the data sent to a server?

Browser-based tools using pdf-lib encrypt entirely client-side, so the PDF never leaves your machine during the operation. Cloud-based tools upload the file, encrypt it on their servers, and return the result. For sensitive material, browser-based encryption is the right choice.

PDF Password Protect

Server-powered

Encrypt and password-protect PDF files online with AES-256 security. Free PDF protector with customizable permissions and access control.

Document Tools

Instant results

Upload PDF File

Drag and drop or click to select a PDF file (max 100 MB)

About PDF Password Protection

PDF password protection adds encryption to your PDF files, preventing unauthorized access and controlling what recipients can do with the document. The PDF specification supports two types of passwords and granular permission controls.

This tool processes everything in your browser. Your PDF files and passwords are never sent to any server, ensuring complete privacy and security for your most sensitive documents.

User Password vs. Owner Password

User Password (Open Password)

The user password is required to open the PDF. Without it, the document cannot be viewed at all. This is the primary access control and should be shared only with intended recipients.

Owner Password (Permissions Password)

The owner password controls document permissions such as printing, copying, and editing. The document owner uses this to manage restrictions. It should be kept private and differ from the user password.

PDF Encryption Standards

AES-256 Encryption

The strongest encryption standard for PDFs. AES-256 (Advanced Encryption Standard with 256-bit keys) is virtually unbreakable with current technology and is the same standard used by governments and military organizations.

AES-128 Encryption

A widely supported encryption standard that provides strong security. While slightly less robust than AES-256, it is still considered secure for most use cases and has broader compatibility with older PDF readers.

RC4 Encryption (Legacy)

An older encryption method (40-bit or 128-bit) still found in legacy PDFs. RC4 is no longer considered secure and should not be used for sensitive documents. Always prefer AES-based encryption for new files.

Best Practices for PDF Security

Use Strong Passwords

Combine uppercase and lowercase letters, numbers, and special characters. Aim for at least 12 characters. Avoid dictionary words, names, and common patterns like "123456" or "password".

Different Passwords for User and Owner

Always use different passwords for user (open) and owner (permissions) access. If they are the same, the user effectively gains owner privileges and can remove restrictions.

Share Passwords Securely

Never send the password in the same email as the PDF. Use a different communication channel (SMS, phone call, secure messaging) or a password manager's sharing feature.

Consider Your Audience

Think about whether recipients need to print or copy text. Overly restrictive permissions can frustrate legitimate users. Balance security with usability based on your specific needs.

Privacy & Security

Secure Server Processing: Your PDF is encrypted on our server using AES-256 via PyMuPDF and immediately returned. Files are never stored on disk.

Zero Data Retention: We do not store, log, or retain any file data, passwords, or usage information. Your documents are processed in memory and discarded immediately after encryption.

How to Use PDF Password Protect

Upload PDF

Drop the PDF into the upload area or pick it through the file dialog. Browser-based protectors process the file entirely client-side, so the document stays on your machine while it's being encrypted.

Set passwords

Configure the user password (which gates opening the document), the owner password (which controls editing and printing), or both. Aim for at least 12 characters drawn from a mix of upper, lower, digits, and symbols — short or predictable passwords undermine the encryption.

Configure restrictions

PDF supports granular permissions for printing, text copying, editing, modification, and signing. Allow whatever the recipient needs to do and deny the rest. Common patterns include 'allow viewing only' or 'allow viewing and printing but not copying'.

Download protected PDF

Download the encrypted file once the tool finishes. Recipients see a password prompt when they open it. Send the password through a different channel than the PDF itself — text the password if you emailed the file, and so on — so a single intercepted message doesn't compromise both.

When to Use PDF Password Protect

Confidential document sharing

Sending a contract, a financial statement, or a medical record by email becomes much safer when the file requires a password to open. Even if the message is forwarded to the wrong recipient, the contents stay locked behind the password.

Tiered access

PDF supports two passwords by design — an owner password that grants full editing rights, and a user password that allows viewing only. Setting both lets you collaborate on a document with restricted permissions for some recipients and full control for others.

Restrict actions

Beyond simple open-to-view, the PDF spec allows you to deny printing, text copying, editing, and form filling individually. This is useful for distributing reading materials, copyrighted content, or any document where you want viewers to read but not redistribute the contents.

Compliance

Industries like healthcare (HIPAA) and finance (PCI, SOX) require sensitive documents to be encrypted in transit and at rest. A password-protected PDF using AES-256 satisfies the encryption requirement for most of these regulations and is one of the simplest ways to meet the bar.

PDF Password Protect Examples

Basic password

Input

PDF + password

Output

PDF requires password to open. Encryption applied (typically AES-256 modern, 128-bit older).

The simplest case attaches a single password and AES-256 encryption to the file. Anyone without the password sees an opening prompt and nothing else; the encryption is strong enough that no realistic brute-force attack will succeed against a long, random password.

Owner + user passwords

Input

PDF + two passwords

Output

Owner password (full access) + user password (view only). Restrictions on actions.

Setting two passwords creates a tiered scheme. The owner password grants full read-write access, while the user password opens the document with whatever restrictions you've configured. Recipients can read the contents without being able to edit or republish them.

Granular permissions

Input

Allow view, deny print/copy

Output

PDF opens normally with the user password, but printing, text copying, and editing are all disabled.

PDF permissions can be configured per action. Common patterns include allowing viewing while denying everything else, or allowing viewing and printing but blocking text copying. Combine these with the dual-password scheme to control exactly what each recipient can do.

Tips & Best Practices for PDF Password Protect

1.The encryption is only as good as the password. Twelve-plus characters drawn from a mix of upper, lower, digits, and symbols pushes brute force into the impractical range; short or predictable passwords undo all the underlying AES-256 strength.
2.Never send the password in the same channel as the PDF. Email the file and text the password, or send the file by Slack and read the password aloud over the phone. Splitting the channels means an intercepted message doesn't compromise the document.
3.Encryption strength varies by PDF version. Modern files use AES-256 (PDF 1.7 and later), older ones use AES-128, and very old versions use a 40-bit RC4 cipher that's been crackable for years. Verify your tool defaults to AES-256.
4.Use the owner and user passwords for their intended purposes. Owner controls editing, printing, and the rest; user controls opening. Setting only the user password is fine for most cases, but anything with restricted actions needs both.
5.Some 'restrictions' are advisory. Print blocking can be bypassed with a screen capture, and text copying can be defeated by OCR'ing screenshots. PDF protection deters casual misuse but won't stop a determined adversary; that's what DRM is for.
6.Losing the owner password is a serious problem. Without it, the only recovery options are paid password-recovery services with no guarantee of success. Store both passwords in a real password manager rather than relying on memory.

Frequently Asked Questions

Modern PDFs use AES-256, which is effectively unbreakable when paired with a long, random password. Older files use AES-128, still strong by any reasonable standard. Legacy 40-bit RC4 from very old PDFs has been crackable for years. The encryption algorithm only matters if the password itself is strong, since weak passwords fall to brute force regardless of the cipher.

PDF Password Protect

Upload PDF File

About PDF Password Protection

User Password vs. Owner Password

User Password (Open Password)

Owner Password (Permissions Password)

PDF Encryption Standards

AES-256 Encryption

AES-128 Encryption

RC4 Encryption (Legacy)

Best Practices for PDF Security

Use Strong Passwords

Different Passwords for User and Owner

Share Passwords Securely

Consider Your Audience

Privacy & Security

How to Use PDF Password Protect

Upload PDF

Set passwords

Configure restrictions

Download protected PDF

When to Use PDF Password Protect

Confidential document sharing

Tiered access

Restrict actions

Compliance

PDF Password Protect Examples

Basic password

Owner + user passwords

Granular permissions

Tips & Best Practices for PDF Password Protect

Frequently Asked Questions

Related Tools

PDF Merge

PDF Split

PDF Rotate

PDF to Text

PDF Watermark

Image to PDF