pdftoolskit.org
PDF (Portable Document Format) utilities, in the browser
Say hi →

Password Protect a PDF — Real AES-256 Encryption

AES-256 · permission flags · verified after saving · never uploaded

Set an open password on a PDF so it cannot be read without it. This is genuine encryption — AES-256 with the PDF 2.0 security handler, computed in your browser tab — not a black rectangle or a flag that a reader is politely asked to honour. After saving, the tool reopens the file to confirm it refuses to open without the password and opens with it, and tells you the result.

Drop PDF files here or click to select

Several at once is fine — the same password is applied to each

    What the reader is allowed to do — once the password has been entered
    no files
    Ready.

    Want something to practise on? sample-10-pages.pdf — more free sample files.

    What "protected" actually means here

    A PDF can be locked in two quite different ways, and most tools blur them. An open password (the spec calls it the user password) encrypts the file's contents: without it there is nothing to read, because the bytes are ciphertext. An owner password leaves the file readable and only sets permission flags — no printing, no copying — that a reader is expected to respect and any determined reader can ignore.

    This tool sets the open password, which is the one that means something. The permission checkboxes set the owner-side flags on top, for readers that honour them. If you need the file to be readable by anyone but harder to print, that is the flags alone — and you should know it is a request, not a wall.

    Why the encryption happens in your tab

    Every other free "protect PDF" service uploads your document to a server, encrypts it there, and sends it back. For a file you are encrypting because it is sensitive, that is exactly the wrong shape: the plaintext, and often the password, cross the network and sit in someone's queue.

    The whole security handler runs here instead, on the standard WebCrypto primitives your browser already ships: SHA-256/384/512 for the password hash and AES-256-CBC for the content. The file never leaves the tab, and there is no server for a subpoena or a breach to reach.

    The verification step

    A tool that claims to encrypt and quietly hands back a readable file is worse than no tool, because you act as if the document is safe. So after saving, the output is loaded back with a separate PDF engine (pdf.js) twice: once with no password, which must fail, and once with your password, which must succeed and report a page count. You get a ✓ line with the result, or a warning if either check did not behave.

    How to password protect a PDF

    1. Drop the PDF you want to lock. Nothing is uploaded — the encryption runs in this tab.
    2. Type the password twice. Anyone who needs to read the file will need this exact string; there is no reset and no recovery.
    3. Optionally set a separate owner password. Leave it blank and it matches the open password, which is what most people want.
    4. Choose what a reader may do once they are in — print, copy text, edit, comment. Untick what should be blocked.
    5. Click Encrypt & download and read the verification line: it confirms the file refuses to open without the password and opens with it.
    6. Store the password somewhere durable before you delete the original, and send it to the recipient over a different channel than the file.

    Choosing a password that is worth setting

    AES-256 is not the weak link; the password is. The encryption key is derived from what you type, so a four-digit PIN on an AES-256 file is a four-digit PIN. Cracking tools try dictionary words and common patterns first, and they try them very fast offline once they have the file.

    FAQ

    Is this real encryption or just a permissions flag?

    Real encryption. The file gets a PDF 2.0 standard security handler at revision 6: a random 256-bit file key, wrapped for your password with the Algorithm 2.B hash, and every string and stream encrypted with AES-256-CBC. Without the password there is no readable content in the file at all, which is why the verification step can prove pdf.js refuses to open it.

    Which encryption strength does it use — 128-bit or 256-bit?

    AES-256 (/V 5 /R 6, AESV3), the strongest the PDF specification defines. Older tools often still emit RC4-128 or AES-128 for compatibility with very old readers; anything from roughly Acrobat X (2010) onwards handles AES-256.

    Can you recover my password if I forget it?

    No, and neither can anyone else. The password is not stored anywhere — it is only used to derive the key that wraps the file key. If you lose it, the document is gone. Write it down before you delete your unencrypted original.

    Will the protected file open on a phone, in Chrome, in Preview?

    Yes. AES-256 PDF encryption is supported by Acrobat, Preview on macOS and iOS, Chrome's and Firefox's built-in viewers, and the common mobile readers — they all prompt for the password. Very old software (pre-2010 Acrobat, some cheap embedded viewers) may not.

    Does encrypting change the file size or the page content?

    Pages are untouched — nothing is re-rendered or recompressed. The file grows slightly: each encrypted stream carries a 16-byte initialisation vector plus up to 16 bytes of padding, so expect a fraction of a percent on a normal document.

    Can I block printing but let anyone open the file?

    Not meaningfully. Permission flags without an open password are advisory — the file is fully readable, and any tool that chooses to ignore the flags will print it, which is exactly what Unlock PDF does. If it genuinely must not be printed, the content should not be in a PDF you hand out.

    Is my password sent anywhere?

    No. There is no network request in this tool at all beyond fetching the PDF library itself. The password stays in a JavaScript variable in your tab and is discarded when you close it. See the privacy policy.