How to Password Protect a PDF With AES-256
By Chinmoy Biswas · Updated , first published
Emailing a payslip, a medical report or a list of customer details as a plain PDF means anyone who gets the email, now or years later, can open it. A password encrypts the contents so the file is unreadable without it. Done properly, that is strong protection. Done carelessly, with old encryption or a birth date as the password, it gives a false sense of security. This guide covers the steps on each device, the encryption types, and the limits you should know before relying on a PDF password.
How do you password protect a PDF for free?
Open the PDF in a tool that encrypts it, set an open password, and save the encrypted copy. Protect PDF does this in the browser with AES-256, free, and the file is encrypted on your device.
Encrypting locally matters here more than for any other PDF job. Sending an unprotected document to a server in order to protect it defeats the purpose. With Protect PDF, neither the file nor the password is sent anywhere. The tool keeps working if the connection drops after the page has loaded.
- Open Protect PDF and choose the document (up to 200 MB). If it already has a password, enter it first so the file can be re-encrypted.
- Type an open password twice. A strength meter shows how hard it is to guess.
- Optionally untick permissions such as printing, copying, editing or commenting.
- Optionally set a separate owner password, if you want to be able to lift those limits later.
- Press Protect PDF. The encrypted copy is checked against your password, then downloads with “protected” in its name.
- Test it: open the download and confirm that it asks for the password.
What is the difference between an open and a permissions password?
An open password is needed to read the document at all. A permissions password only controls what readers may do after opening, such as printing or copying. Only the open password protects privacy.
Why permissions are a request, not a lock
Acrobat, Preview, Chrome and most readers honour permission flags. They are still rules that software chooses to follow. Anyone who can open the file can take screenshots, and some programs ignore the flags entirely. Use permissions to signal intent, not to guard secrets.
If you do not set an owner password in Protect PDF, a long random one is generated and discarded. Nobody, including you, can then lift the limits with a password.
| Open password (user) | Permissions password (owner) | |
|---|---|---|
| Asked for when | Opening the file | Changing or lifting restrictions |
| Protects | The entire content | Printing, copying, editing, commenting |
| Enforced by | Encryption | Reader software that chooses to comply |
| Good for | Confidential documents | Discouraging casual copying |
Built-in options on Mac, Windows, iPhone and Android
Mac and iPhone can lock a PDF without extra software. On Windows it depends on having Microsoft Word. Android has nothing built in.
Mac: Preview
Open the PDF in Preview and choose File > Export. Click Permissions, tick Require Password To Open Document and enter the password. Preview also asks for an owner password in the same dialog. Apple describes the steps in Password-protect a PDF in Preview. On older macOS versions the export dialog shows a single Encrypt checkbox instead.
Windows: Microsoft Word
Windows itself cannot encrypt a PDF, and Microsoft Print to PDF has no password option. If the document starts in Word, choose File > Save As, pick PDF, click Options and tick Encrypt the document with a password. For a PDF that already exists, use the browser tool.
iPhone and iPad: Files
On iOS 15 or later, open the PDF in Files, tap the arrow next to the file name or the Share button, and choose Lock PDF. Enter the password twice. The lock is applied to the file itself, so copy the PDF first if an unlocked version should remain. There are no permission settings.
Android
Android has no system feature for PDF passwords, and the Google Drive app cannot add one. Open Protect PDF in Chrome. Encryption runs on the phone, so a payslip or an ID scan stays on the device.
Why does the encryption type matter?
Because old PDF encryption can be broken in minutes, whatever the password is. Only AES with a long key leaves the password as the sole way in.
The first PDF encryption used the RC4 cipher with a 40-bit key. A 40-bit key can be found by trying every possibility on an ordinary computer, so the password does not matter. Later versions moved to 128-bit RC4, then 128-bit AES. AES-256 arrived with Acrobat 9 in 2008 and became the standard method in PDF 2.0, which deprecates the older ones.
AES is the cipher specified by the US National Institute of Standards and Technology in FIPS 197. No practical attack on it is known. The weak point becomes the password.
How to check what an existing PDF uses
In Adobe Acrobat Reader, open the file and choose File > Properties > Security. The Encryption Level line shows the method, for example 256-bit AES. If a file you received says 40-bit or 128-bit RC4, ask the sender for a newer export, or unlock it with its password and protect it again with AES-256.
Will an AES-256 PDF open everywhere?
Yes, in anything current. Acrobat, Preview, Chrome, Edge, Firefox and the built-in viewers on iPhone and Android all open AES-256 files. Only readers from before about 2008 fail, along with some embedded viewers in old printers and office devices.
| Method | Introduced | Status today |
|---|---|---|
| RC4 40-bit | PDF 1.1 (1994) | Broken. Avoid. |
| RC4 128-bit | PDF 1.4 (2001) | Weak cipher. Avoid. |
| AES-128 | PDF 1.6 (2004) | Acceptable |
| AES-256 | Acrobat 9 (2008), PDF 2.0 | Recommended |
How long should a PDF password be?
Use at least 12 characters, or four unrelated words. Length matters more than symbols, because an encrypted PDF can be attacked offline with no lockout.
A website blocks an attacker after a few wrong tries. A file cannot. Someone who holds the PDF can test millions of guesses, starting with names, dates and common patterns. “Smith2026” or a date of birth falls quickly. A random passphrase such as four words picked from a list, the Diceware method, is far harder to guess and easier to say over the phone.
- Avoid names, birthdays, postcodes and the file name.
- Do not reuse a password from an online account.
- A password manager can generate and store the password.
- PDF passwords are limited to 127 characters.
Sharing the password
Sending the password in the same email as the attachment protects nothing if that email is intercepted or forwarded. Use a different channel: a text message, a phone call or a messaging app.
Which second channel to use
A phone call is the hardest to intercept and leaves no written record. A text message or an end-to-end encrypted messaging app is a good second choice. Avoid a second email to the same address, because anyone with access to the inbox sees both messages. For a client you deal with often, agree on one strong password in person or by phone and reuse it only for that client.
Documents for several people
For regular mailings such as monthly payslips, use a different password for each recipient, so one person cannot open another's file. A pattern each recipient already knows, such as an employee number combined with part of a postcode, is easier to manage than random passwords. It is also weaker, because colleagues can guess it. Keep patterns for low-risk documents.
Limits to be aware of
- A forgotten open password cannot be recovered by anyone, including this site. There is no reset link and no master key. Keep an unencrypted original somewhere safe.
- Once the recipient opens the file, they can save, print or screenshot it. Encryption protects the file in transit and in storage, not after it is read.
- The file name is never encrypted, and document properties can remain readable in some files. Rename the file and run Remove PDF Metadata first if the title itself is sensitive.
- A password does not hide parts of a document from someone who has it. To remove a name or number for every reader, use Redact PDF before encrypting.
- Some upload portals reject encrypted PDFs. Send those an unprotected copy over the portal's own secure connection.
- To remove the password later, use Unlock PDF with the password you set.
FAQ
Questions people also ask
Can I password protect a PDF without Adobe Acrobat?
Yes. Preview on a Mac, the Files app on an iPhone and Microsoft Word on Windows can all save a password-protected PDF. On any device, Protect PDF encrypts the file with AES-256 in the browser, free and without uploading it.
Is a password-protected PDF really secure?
Yes, if it uses AES-256 and a long password. The encryption itself has no known practical attack, so the password is the weak point. A short or guessable password can be found by software that tries millions of guesses offline.
What happens if I forget my PDF password?
The contents are lost. An open password encrypts the file, and no service can reset it. Recovery tools only guess, which fails against a strong password. Keep an unprotected original or store the password in a password manager.
Can I email a password-protected PDF safely?
Yes, as long as the password travels separately. Attach the encrypted PDF to the email and send the password by text message or phone call. If both are in the same message, anyone who reads that message can open the file.
Free tool
Try Protect PDF
Lock a PDF with a password before you email or share it. Encryption runs in your browser, so the document and the password never leave your device. Runs in your browser, so the file never leaves your device.
Open Protect PDF