Why people password-protect PDFs in the first place
A PDF is a sealed delivery format — but "sealed" doesn't mean "secret". Anyone who receives an unprotected PDF can open it, copy from it, print it, edit it in dozens of free tools, and forward it. For contracts, salary letters, medical records, tax filings, board packs, M&A diligence and anything covered by GDPR, HIPAA, DPDP or CCPA, you need real cryptographic confidentiality plus permission controls.
How PDF encryption actually works
The PDF specification defines a Standard Security Handler that derives a symmetric key from a password using a specified algorithm. Historically this was 40-bit RC4 (PDF 1.1), then 128-bit RC4 (PDF 1.4). PDF 1.6 added AES-128, and PDF 2.0 / ISO 32000-2 added AES-256 with a much stronger password-to-key derivation. The encrypted content streams and string objects live inside the same PDF file structure — bookmarks, forms, annotations, accessibility tags and metadata are preserved, only the bytes that carry visible content are wrapped.
The five layers of a real PDF protection engine
- Analyzer — reads the cross-reference table, catalog, info dictionary and (when present) signature dictionaries, outline trees and AcroForm root.
- Validator — confirms the PDF parses cleanly, isn't already encrypted, isn't currently mid-signature.
- Security assessment — flags weak prior encryption, exposed metadata, open permissions and signature/PDF-A interactions.
- Encryption engine — applies AES-128 or AES-256 with the user password, owner password and the permission bitmask defined by the PDF spec (table 22 in ISO 32000-2).
- Post-flight validator — re-opens the protected PDF, verifies the encryption dictionary, page tree, outlines, forms and metadata, and emits a signed audit report.
User password vs owner password — choose both
The user password gates opening the document. The owner password gates lifting restrictions. Reusing the same string for both is the single most common error in real-world PDF protection. Use a long random string for the owner password (this tool can generate one), and a shorter human-rememberable string for the user password if you intend to share it with the recipient.
Permission flags and what they really mean
The PDF spec defines a 32-bit permissions integer with bits for print, modify, copy, annotate, fill forms, accessibility, assemble, and high-resolution print. Compliant readers enforce these. Don't rely on them against a determined adversary — they are a deterrent and a statement of intent, not a vault. The vault is the user password plus AES-256.
Password strength: length beats complexity
Modern password-cracking pipelines on commodity GPUs can attempt millions of AES-128 PDF candidates per second. AES-256 with PDF 2.0's SASLprep + iterated PBKDF is dramatically slower to attack, but a four-character password is broken either way. Aim for 12+ characters with at least three character classes, or use a four-word passphrase. The strength meter in this tool reports Shannon entropy in bits — anything above 60 bits is comfortable for non-targeted protection, anything above 80 bits is suitable for adversarial settings.
Signed documents and PDF/A — the two traps
Adding encryption rewrites parts of the PDF that signatures cover, which invalidates them. Encryption is also explicitly disallowed in PDF/A profiles because PDF/A guarantees the file can be opened forever without external dependencies — and a password is an external dependency. The tool detects both cases on upload and warns you before encrypting.
Privacy: the part no one talks about
"Free" online Protect PDF converters are, almost without exception, server-side. Your salary letter, contract, NDA or tax return is uploaded, parsed on someone else's machine, and either logged, cached, indexed for ad targeting, or all three. For GDPR-, DPDP- and HIPAA-bound documents, that single upload is the breach. Browser-based encryption sidesteps the issue entirely — open your network tab while protecting on this page and you'll see exactly zero outbound requests carrying your file.
The full Protect PDF workflow professionals actually use
- Finalise the PDF (merge, sign, OCR) before applying encryption.
- Pick a Security Profile or configure permissions explicitly.
- Generate a distinct random owner password and a shareable user password.
- Encrypt with AES-256 here. Download the protected PDF and the JSON audit report.
- Send the protected PDF and the user password through different channels (e.g. file via email, password via Signal/SMS).