Password-protect a PDF

How to password-protect a PDF

1. Drop your PDF above. Drag it in, or click to browse.
2. Set a password. Type it twice to confirm. The advanced options let you restrict printing, copying or editing as well.
3. Click Protect PDF, then Download. The encrypted copy is built on your device. Anyone opening it needs the password.

Encryption that happens on your device

The average “protect PDF” site works like this. Your document goes up to a server, gets encrypted there, and comes back by download or email. Your confidential file has passed through someone else's computer, and on some sites the password went with it. Sleek PDF encrypts the file right here in the browser, with standard encryption any reader can open. Do it before a contract or a bank statement goes out by email.

Two passwords that do different jobs

PDF has two kinds of password, and confusing them is behind most disappointments with this feature.

The user password, sometimes called the open password, is the one that actually matters. Without it the file cannot be decrypted, and its contents are unreadable. This is real cryptography, and it is what you want when a document must not be readable by whoever finds the email it was attached to.

The owner password governs the permissions: whether the document may be printed, copied from, or edited. Nothing enforces these restrictions cryptographically. The file is fully decrypted, and every reader is asked to respect a set of flags saying what the author would prefer. Well-behaved software honours them. Software that doesn't is a search away, and every one of those restrictions can be stripped in seconds. Treat permissions as a "please don't" sign, not a lock.

If you set only one password here, it serves as both, so anyone who can open the file also has full rights over it. Setting a separate owner password is what makes the permission limits mean anything at all to someone holding just the open password.

Choosing a password, and getting it to the recipient

Encryption strength is decided by the document itself: the tool matches the strongest scheme the file's PDF version supports, which for most modern documents means AES. Older files declare older versions and get correspondingly older schemes. Either way the practical weak point is the password and how it travels, not the cipher.

• Length beats complexity. Attacks on PDF passwords are brute-force guessing, and each extra character multiplies the work far more than swapping an a for an @ does. Three or four unrelated words is both stronger and easier to read down a phone.
• Never send the password with the file. A password in the same email as the attachment protects against nothing at all, since anyone reading one is reading the other. Send it by a different route: a text message, a phone call, a password manager's share link.
• Don't use a password you use elsewhere. This one gets typed by other people, written in notes, and forwarded.
• Keep an unprotected original. There is no recovery. A lost password means a lost document, and no tool on this site or anywhere else can help.

What a password doesn't do

Encryption controls who can open the document, not what happens next: once a recipient opens it, they can save a copy, screenshot it, print it, or pass on both file and password. Nor does it clean what is inside the file: metadata naming the author, or text sitting invisibly under a black rectangle somebody drew, is encrypted along with everything else and fully readable to anyone who opens it. Encrypt as the last step, after redacting and checking what the file carries, not instead of them.

To go the other way on a file whose password you know, Unlock PDF removes it.

Frequently asked questions