Protect PDF

Add an open password to a PDF, or restrict printing, copying and editing, using AES-256 encryption. Runs in your browser — your files are never uploaded.

or drop a file here

Up to 50 MB
  1. 1Choose

    Choose a PDF.

  2. 2Adjust

    Enter an open password and tick the actions you want to restrict.

  3. 3Download

    Click “Protect PDF” and download the encrypted copy.

Encrypt a PDF before you send it

Set an open password and the document is encrypted with AES-256; nobody can read it without the password, whichever PDF reader they use. Share the password through a different channel than the file — send the PDF by email and the password by text message, for instance.

You can also restrict printing, copying or editing. Be aware of what that means: permission restrictions are enforced by PDF readers rather than by encryption of the content, so treat them as a clear statement of intent, not as strong protection. For anything sensitive, use an open password.

The password never leaves your browser

With an upload-based service, both your confidential document and the password that protects it travel to somebody else’s server. Here, encryption is performed on your device by qpdf, an open-source PDF library compiled to WebAssembly, and neither the file nor the password is sent anywhere.

There is no way to recover a forgotten password — not for you, and not for us, since we never see it. Store it in a password manager.

Questions

Are my files uploaded to a server?

No. Everything runs inside your browser, so your files never leave your device. Close the tab and nothing is left behind.

What encryption is used?

AES-256, as defined by the PDF 2.0 standard. All mainstream PDF readers support it.

What if I forget the password?

There is no way to recover it. Keep it somewhere safe, such as a password manager.

What makes a good PDF password?

Length matters most. Four or five random words, or 14+ random characters from a password manager, is far stronger than a short password with symbols. Avoid birthdays and ID numbers, which are the first things an attacker tries.