Protect PDF
Protect PDF
Encrypt your PDF with AES-256 password protection
- Runs in your browser
- Nothing uploaded
- No sign-up
- Free, no daily limits
- 1Add your file
- 2Choose settings
- 3Download
🔒 AES-256 Encryption
Your PDF will be encrypted with industry-standard AES-256 encryption. Set passwords and customize permissions for printing, copying, and editing.
100% Private: All processing happens in your browser. Your files never leave your device.
Your file is safe
It is processed inside this browser tab and never uploaded, and it is gone when you close the page.
Good to know
- With only a user password set, it is also used as the owner password.
- Printing can be allowed at full quality, at low quality only, or not at all.
- Permission flags are honored by compliant PDF viewers; software that ignores them can still print or copy.
- Files are encrypted with AES-256.
Last updated
Protect PDF encrypts a PDF with standard cryptographic protection using the @cantoo/pdf-lib library, entirely in your browser without uploading your file. Before encrypting, it sets the document internal header to PDF version 1.7 Extension Level 3. This routes the encryption process through a 256-bit key with the AESV3 cipher, ensuring real AES-256 security rather than an outdated 40-bit or 128-bit fallback. You can define a password required to open the file, a separate password for administrative access, and configure permissions such as printing or copying.
Encryption restricts who can access the document and what compliant PDF software permits users to do with it. It does not delete or censor any underlying text or images. If you need to permanently purge sensitive details like tax numbers or personal contact data before sharing, use Redact PDF to delete text runs from the content stream, then return here to protect the final file.
How it works
1. Drop a PDF
Select or drag a .pdf file onto the upload area. Files over 100 MB, or files not recognized as standard PDFs, are rejected immediately before reading.
2. Set a user or owner password
Enter a User Password (required to open and view the PDF) and an Owner Password (required to alter permissions). At least one password field must be populated before encryption can proceed.
3. Configure document permissions
Printing has three choices: full quality, low quality only, or no printing. Six toggles cover the other actions: modifying, copying, annotating, filling forms, accessibility screen readers, and document assembly. Select All grants everything at full print quality; Deselect All turns everything off, printing included.
4. Encrypt and download
Click Encrypt PDF to generate keys and encrypt the document in browser memory, then click Download Protected PDF to save the secured file.
When you'd use it
Emailing a salary slip or mark sheet
Attaching a password-protected copy prevents the document from being opened by anyone who intercepts the email or accesses a shared inbox without knowing the password sent separately.
Sharing an offer letter or contract draft
A user password required to open the file adds protection against a draft document being read by unauthorized parties, beyond relying only on cloud folder permissions.
Distributing read-only materials
Disabling text copying and modifying while leaving the document openable allows you to share materials for review without permitting recipients to extract text easily in standard readers.
Setting administrative permissions for submissions
Configuring only an owner password keeps the file openable for public viewing while requiring administrative credentials to lift print or copy restrictions later.
How does AES-256 encryption protect PDF files?
Prior to executing encryption routines, the tool updates the PDF header to declare version 1.7 Extension Level 3. That header string signals the @cantoo/pdf-lib security module to select revision 5, a 256-bit cryptographic key, and the AESV3 cipher filter. In Adobe Extension Level 3 and ISO 32000-2, AESV3 represents 256-bit AES encryption. Revision 5 is the Acrobat 9 scheme. PDF 2.0 replaced it with Revision 6. Microsoft Edge 156 opened our Revision 5 test file without complaint.
Without this header declaration, older PDF libraries frequently default to 40-bit RC4 or 128-bit AES encryption. The explicit version declaration ensures that your document receives strong, current cryptographic protection against unauthorized access.
| Specification level | Security handler revision | Key length | Cipher algorithm |
|---|---|---|---|
| PDF 1.1 - 1.3 | Revision 2 | 40-bit | RC4 stream cipher |
| PDF 1.4 - 1.6 | Revision 3 or 4 | 128-bit | RC4 or AES-128 |
| PDF 1.7 Extension Level 3 | Revision 5 | 256-bit | AES-256 (AESV3 cipher) |
| ISO 32000-2 (PDF 2.0) | Revision 6 | 256-bit | AES-256 with SHA-256/384/512 |
Source: Adobe Extension Level 3 / ISO 32000-2 Specification, checked October 28, 2026
What is the difference between a user password and an owner password?
A user password controls viewing access: anyone opening the document must enter this password to see its pages. If you specify only a user password and leave the owner field empty, the code reuses the user password as the owner password. This means whoever holds viewing credentials also holds administrative rights to modify permissions.
An owner password controls permissions rather than viewing: setting only an owner password allows anyone to open and read the file without a password prompt, but entering the owner password is required to remove restrictions or edit permissions. Use this configuration when you want a document to be publicly readable but restricted from copying.
What can PDF password protection not prevent?
Permissions are flags stored in the file's encryption dictionary (the /P entry). Choosing No for printing clears both print bits, Low quality only sets the print bit without the high-quality bit, and Full quality sets both. Each other toggle maps to one bit of its own. A compliant viewer reads these flags and disables the matching actions, but the flags are only a request: software that ignores them can still print or copy the file once it is open.
In Microsoft Edge, with Allow Copying unchecked, Edge let us highlight the text, but Ctrl+C put nothing on the clipboard. We have not re-tested printing in Edge since the No option was added, so we make no claim here about how Edge treats it.
Password protection does not delete or sanitize sensitive data from the document stream. All original text and graphics remain inside the file, protected only by the encryption wrapper. If you need to permanently remove account numbers or confidential information, use Redact PDF before applying a password. If you later need to strip passwords from files you own, use Unlock PDF.
Adobe documents that an Acrobat permissions password can restrict printing, editing, copying and commenting (Adobe: Password security overview, checked 2026-10-29). We have not tested other viewers, so treat the flags as a request that each app may or may not honor.
| Action in Edge | Unprotected copy of the file | Protected file |
|---|---|---|
| Open the file | Opens | Opens, with the banner "This file has limited permissions" |
| Select all, then Ctrl+C | Text lands on the clipboard | Clipboard unchanged |
Frequently asked questions
Is the AES-256 encryption real or simulated?
It is standard 256-bit AES encryption. The code sets the PDF header to version 1.7 Extension Level 3, directing the library to use security revision 5 and the AESV3 cipher filter.
What happens if I leave the owner password blank?
The tool automatically copies your user password into the owner password field. Anyone who knows the password to open the file can also modify or remove document permissions.
What happens if I leave the user password blank?
The PDF opens freely for reading without a password prompt. However, the owner password is required to change permissions or strip document restrictions later.
Does disabling printing prevent all printing?
Choosing No for printing clears both print permission bits, so viewers that follow PDF permission flags disable printing entirely. The Low quality only option is there if you want to allow a degraded print. Permission flags are only enforced by compliant viewers; software that ignores them can still print the file.
Does protecting a PDF remove sensitive text?
No. Encryption restricts access to the file container, but all text and image data remain inside. Use /pdf/redact to permanently purge sensitive content before encrypting.
What is the file size limit for encrypting PDFs?
Documents up to 100 MB can be encrypted. Because all processing runs locally in browser memory, no file data is ever uploaded to external servers.