How to Password-Protect a PDF with AES-256 Encryption

What password protection does to a PDF

Protecting a PDF with a password encrypts its contents. The text, images and fonts inside the file are scrambled with a key, and the only way to get that key is to type the right password. You can still copy, email or upload the file, but without the password it is unreadable.

The method PDF Logic uses is AES-256, the strongest encryption the PDF format defines and the same family of cipher that protects encrypted disks and secure websites. Nobody breaks AES-256 by trying every key. What people break is the password. So two things decide how safe your file is: the password you choose and how you share it.

Opening password and permissions password

A PDF can carry two passwords, and they do very different jobs.

Permissions are weaker for a simple reason. Once someone opens the file with the opening password, their software holds the key and can read every page. The restrictions are instructions that ask the reader to disable Print or block copying. Adobe Acrobat and other mainstream readers follow them. Software written to ignore them can, a point the qpdf encryption documentation makes plainly. Use permissions to prevent accidents, such as a colleague editing the approved version, and rely on the opening password for secrecy.

Protect a PDF step by step

1. Choose the file. Open Protect PDF and select one PDF, up to 30 MB. The tool first checks the file on your device to make sure it is a readable PDF that isn’t already protected.
2. Set the opening password. Type it in Opening password and again in Confirm opening password. Or select Generate password, which creates a random 20-character password and fills in both boxes for you.
3. Save the password now. Select Copy password and paste it into your password manager before you do anything else.
4. Read the strength meter. Passwords under 10 characters, or built on common words and repeats, are marked Weak, and you have to tick “Use this weak password anyway” to continue. Ten to 15 characters rates Fair; 16 or more rates Strong.
5. Add permissions if you want them. Open Advanced permissions and tick “Restrict printing, copying & editing”. Set Printing to High resolution, Low resolution or Not allowed, then untick anything recipients shouldn’t do: Copy text & images, Edit document content, Add comments & annotations, Fill form fields, or Reorder, insert & remove pages. Enter a Permissions password that is different from the opening password.
6. Encrypt. Select Protect PDF. The file and passwords are sent to our server over an encrypted connection. The server encrypts the PDF, confirms that the result really does require the password and uses AES-256, and deletes its temporary copy when the job finishes.
7. Download. Select Download protected PDF. The new file has “-protected” added to its name, and your original is unchanged.

Choose a password that holds up

An encrypted PDF can be attacked offline. Someone who has the file can run guessing software against it for as long as they like, with none of the lockouts a website applies after a few wrong tries. Short passwords and anything based on a name, a date or a dictionary word fall quickly. Long, unpredictable ones don’t.

• Go long. Sixteen random characters, or four or five unrelated words, is a sensible minimum for anything sensitive. The upper limit is 127 characters of plain English text; accented letters and other scripts use up the allowance faster.
• Make it unique. Don’t reuse your email or banking password. Everyone you send the file to will know this one.
• Send it separately. If the PDF goes by email, send the password by phone or a messaging app. When both travel in the same email, anyone who reads that email has everything.
• Mind look-alike characters. Read aloud or copied by hand, O and 0 or l and 1 get mixed up. Generated passwords leave those characters out.

Check the protected copy before you send it

1. Open the downloaded file. It should ask for the password before it shows a single page.
2. Enter the opening password and page through the document to confirm nothing is missing.
3. If you set permissions, select View document permissions on the result screen, or open the document properties in Adobe Acrobat Reader and look at the Security tab. Both list what is allowed and what isn’t.
4. If your recipient will read the file on a phone, try it on a phone.

What can go wrong

“This PDF already has protection”

A file that is already encrypted has to be unlocked before it can take a new password. Remove the existing one with Unlock PDF, which needs the current password, then protect the unlocked copy.

The recipient can’t open it

Usually the password was mistyped. Check capital letters, stray spaces picked up when copying, and look-alike characters. If the password is right, the app may be too old to understand AES-256. Current versions of Adobe Acrobat Reader and the PDF viewers built into Chrome, Edge and Firefox all open these files; an outdated reader, or an older e-reader or printer, may not.

You forgot the password

There is no reset. Go back to the unprotected original and protect it again, this time saving the password first.

The PDF was digitally signed

Encrypting creates a changed copy of the file, so an existing certificate-based signature will no longer validate. Keep the signed original and ask the recipient whether they need the signature to validate. Our guide to electronic and digital signatures explains why any change breaks the seal.

What encryption does not do

A password controls who can open the file. It doesn’t change what is inside. Anyone you give the password to can read every page, pass the password on, or photograph the screen.

If part of the document shouldn’t be seen by the recipient at all, remove it with Redact PDF before you protect the file. Our redaction guide explains why a black rectangle isn’t enough. The file name and size also stay visible to anyone who handles the file, so keep secrets out of the name.

When another tool is the better choice

• The file must not leave your computer. Protect PDF uploads the document to encrypt it. To do the same job offline, export with a password from Word for Windows (Save As, PDF, Options, “Encrypt the document with a password”), LibreOffice (Export as PDF, Security tab) or Adobe Acrobat. See browser and server processing for which PDF Logic tools upload files.
• You need to take access back later. A password can’t be revoked once it is shared. Use a file-sharing service with expiring links or per-person access instead.
• You need to prove who sent it. That is a job for a digital signature, not a password.

Frequently asked questions

Can PDF Logic remove a password I’ve forgotten?

No. Unlock PDF removes protection only when you supply the correct password, and a strong password on an AES-256 file can’t realistically be guessed.

Is AES-256 safe enough for confidential documents?

The encryption itself is. The practical risks are a weak password, a password sent alongside the file, and recipients who share it. If you handle regulated data, follow your organization’s rules on where files may be uploaded.

Why can someone still copy text from my restricted PDF?

Because permissions are requests, not locks. Mainstream readers honor them, other software can ignore them, and anyone can retype or screenshot what they see.

Do recipients need the permissions password to read the file?

No. The opening password is enough. The permissions password also opens the file, without the restrictions, which is why you shouldn’t share it.