How to protect a PDF with a password
Bank statements, contracts, payslips, medical records: some PDFs are simply not meant to be read by just anyone. Protecting them with a password is the standard answer — and contrary to popular belief, you need neither a paid copy of Adobe Acrobat nor any installed software: AES encryption compliant with the PDF standard can be applied for free, directly in your browser.
It still has to be done properly. A weak password can be cracked in minutes with today's tools; a password sent in the same email as the file protects nothing at all; and a forgotten password makes the document permanently unreadable, because serious encryption — by definition — has no recovery backdoor.
This guide explains what PDF encryption actually does, how to choose a solid password, what permissions (printing, copying, editing) and the owner password are for, and which mistakes to avoid. It ends with a case people often forget: when a password is not enough and sensitive information needs to be permanently redacted instead.
What PDF encryption actually does
Password-protecting a PDF does more than “lock” the file: its entire content is encrypted with the AES algorithm, the same standard used by banks and governments. Without the password, the file is just an unreadable stream of bytes — opening it in a text editor or another reader reveals nothing. This is very different from a mere software restriction: the protection travels with the file everywhere, whatever PDF reader, operating system or device is used to open it.
Choosing a password that holds
The strength of the encryption depends entirely on the password. Aim for at least 12 characters mixing upper case, lower case, digits and symbols — or better, a passphrase of four random words, easier to remember and just as robust. Avoid anything guessable: birth dates, the recipient's name, the company name. Our tool shows a live strength indicator as you type. Finally, store the password in a dedicated password manager: it is the only insurance against forgetting, which is irreversible.
Open password or owner password?
The PDF standard distinguishes two roles. The open password (user password) is required to read the document: it is what protects confidentiality. The owner password grants full control: changing permissions, removing the protection, reorganising pages. Setting a separate one is useful in a business context: you hand the open password to readers and keep the owner password to yourself. If you don't set one, the same password plays both roles.
Restricting printing, copying and editing
Beyond opening the file, you can grant or deny precise permissions: printing (blocked, low-resolution 150 dpi, or high-resolution), copying text and images, editing content, annotating, filling forms and reorganising pages. A common use case: allowing a quote to be read and printed while blocking modification. Keep one limit in mind: these permissions are honoured by standard-compliant readers, but only open-password encryption is an absolute, cryptographic protection.
The three mistakes that ruin the protection
First mistake: sending the password through the same channel as the file. One intercepted email then hands over both; send the password by another route (text message, phone call, encrypted messenger). Second mistake: reusing an existing password — your email password, for instance. Third mistake: not keeping an unprotected copy of the original somewhere safe. If the password is forgotten, no honest service will be able to decrypt the file — which is precisely the proof that the encryption works.
When a password is not enough: redact
A password protects the whole document, but sometimes you need to distribute a file while hiding only specific information: bank details, social security numbers, third-party names. Drawing a black highlight in an editor is not enough — the text remains underneath the rectangle and can be recovered with a simple copy-paste. Use a real redaction tool: our Redact tool flattens the affected pages to images and truly removes the hidden content from the file. Then combine redaction followed by encryption for maximum protection.