How to Password-Protect a PDF (and Unlock One You Own)

Last updated: August 2026

Bank statements, salary slips, medical reports, and signed contracts routinely end up as PDFs sitting in a Downloads folder or an email thread. A password turns that file from "readable by anyone who finds it" into something meaningfully protected. This guide covers what PDF password protection actually does, when you need it, and how to add or remove it without handing the file to a third-party server.

What a PDF Password Actually Protects

Modern PDF encryption (AES-128 or AES-256) scrambles the entire content of the file at the byte level. Without the correct password, the file cannot be opened, previewed, or indexed by search — not by a casual viewer, not by cloud storage generating a thumbnail, not by an email attachment scanner. This is different from just hiding a file in a folder; the protection travels with the file itself, wherever it is copied or sent.

PDFs support two separate passwords, often confused with each other:

A user password (open password). Required just to open and view the file. This is what most people mean by "password-protect my PDF."
An owner password (permissions password). Controls what a person who can open the file is allowed to do — printing, copying text, editing. It does not stop the document from being viewed.

For genuinely sensitive documents, set a user password. An owner-password-only PDF opens for anyone; it just restricts what they can do with it afterward, which is a much weaker guarantee.

AES-128 vs AES-256: Which Should You Choose?

Setting	AES-128	AES-256
Compatibility	Opens in essentially every PDF reader, including older versions	Requires a reasonably modern reader (most software from the last decade)
Strength	Strong — not practically breakable by guessing the key directly	Stronger key length; the current standard for new documents
When to use	Sharing with someone whose software you're unsure about	Default choice for anything sent or stored today

In practice, the password itself is almost always the weaker link, not the AES key length. A six-digit numeric password is guessable in seconds regardless of whether the encryption is AES-128 or AES-256; a random 12+ character password is effectively unbreakable either way. Spend your effort on the password, not the algorithm.

Choosing a Password That Actually Holds

Avoid your date of birth, phone number, or account number — banks and institutions often auto-lock statements with exactly these, which is precisely why they're the first thing an attacker tries.
Use at least 10–12 characters mixing letters, numbers, and a symbol if the recipient can handle it.
Send the password through a different channel than the file itself — a text message if the PDF went by email, a call if it went by chat. A password sitting in the same email as the attachment protects against almost nothing.

Adding a Password to a PDF

Use our free Protect PDF tool — it encrypts the file with real AES-128 or AES-256 entirely inside your browser using a WebAssembly build of the open-source QPDF library, so the document and the password you choose never leave your device. Open the tool, select your PDF, choose a password and encryption strength, and download the protected file.

Removing a Password from a PDF You Own

If you have the password and just want a copy you can merge, print, or archive without re-typing it every time, our Unlock PDF tool does the reverse: enter the password once, and it produces a decrypted copy, again fully on-device. This only works for the user (open) password — see our companion guide on removing a PDF password for a fuller walkthrough, including what to do if you've genuinely forgotten the password.

Note: only remove a password from a document you own or have explicit permission to unlock. Bypassing protection on someone else's file is a different situation entirely, both ethically and often legally.

A Few Situations Worth Calling Out

Before merging protected statements. Most PDF tools, including our own merger, cannot read a page that is still encrypted. Unlock each file first, then merge.
Re-protecting after editing. If you unlock a file, edit or merge it, and it needs to stay confidential, re-apply protection as the very last step before sending.
Long-term archives. A password stops casual access but is not a substitute for encrypting the drive or folder the file lives in if you're storing years of sensitive documents.

Ready to protect a file? Try Protect PDF or Unlock PDF — both run entirely in your browser, no uploads, no signup.