What changes
Encryption requires a password to open the new file. Permission flags are guidance to viewers, not reliable DRM.
Password protect PDF
Add an open password and PDF access permissions with local AES-256 encryption. Your PDF and password never leave this browser.
Runs locallyNo uploadYou control saved copies
AES-256 PDF protection
qpdf runs in a disposable browser worker. The PDF and password are never uploaded or stored.
Local qpdf worker · no upload · cancellable
Protect a PDF with an AES-256 open password
A dedicated qpdf WebAssembly worker applies AES-256 encryption and verifies the result with the owner password before download.
For a reliable result
- Choose a PDF and enter a strong, unique open password.
- Optionally set viewer permission flags with the understanding that readers may ignore them.
- Protect, download, test the password, then store it separately.
Check the download
Open the download in a second trusted viewer before deleting the source. Losing both passwords can make recovery impractical.
Know before processing
Passwords are cleared after every attempt and never stored, so this site cannot recover them. Existing digital signatures can be invalidated by modification.
Quick answers
- Are print and copy restrictions guaranteed?
- No. AES-256 encryption protects opening the file, but print, copy and modification permissions are viewer policy flags that some applications may ignore.
- Can PDF for Free recover a forgotten password?
- No. Passwords are cleared after processing and are never stored. Test the protected download and keep the password separately before deleting the source.
Require a password to open a PDF and verify the protected copy
Create an encrypted PDF with an opening password and optional owner password for full access. Print, change and copy settings express permissions to viewers. The tool applies AES-256 encryption locally and checks the output before download.
Distinguish an opening barrier from control after opening. A person who can view the document can still reproduce its visible content, and some applications ignore usage permission flags. If information must not reach the recipient at all, remove it before sharing rather than relying on print or copy restrictions.
Choose the password and permissions for the actual sharing task
| Your situation | Recommended approach |
|---|---|
| Only intended recipients should open the file | Set an open password that you can store and communicate securely. Use a unique password for the real document; the public example below is only for the synthetic sample. |
| You want a separate full-access credential | Set an owner password different from the open password and keep it to yourself. If left blank, the tool uses the open password for both roles. |
| You want viewers to restrict printing or changes | Choose the relevant permission flags but test the recipient's viewer. These are requests to the application, not dependable controls against copying content. |
| The source is already encrypted | Unlock it with a known authorized password first, then protect the resulting copy with the new settings. This tool does not recover unknown passwords. |
Protect a public sample and check its opening password
Use device-document-lab.pdf, which contains five synthetic pages. The demonstration passwords are public and must not be used for confidential files.
- Choose device-document-lab.pdf. Enter Example-open-2026! as Open password and Example-owner-2026! as Owner password.
- Set Printing to Not allowed, Changes allowed to None, and leave Allow copying text and images unchecked.
- Select Protect PDF and download the protected copy. Confirm that the result reports five pages and 256-bit encryption.
- Open the download in a trusted PDF viewer. Check that it requests a password, rejects an incorrect value and opens with Example-open-2026!. Inspect the pages after opening.
Expected result. The sample becomes an encrypted five-page PDF that requires an accepted password to open. Its permission settings are stored in the file, but whether a viewer enforces them is a separate check. The original sample remains unencrypted.
Check the downloaded result
- Open the actual downloaded copy, not the original source tab. Check both password rejection and successful opening before sharing it.
- Inspect page count, visible text, form values and other required features after opening. Encryption validation does not establish that every document feature behaves identically in every viewer.
- Store the passwords before leaving the page. The fields are cleared after each processing attempt, and the site does not provide password recovery.
- Keep the unencrypted original under your own control. Creating a protected copy does not encrypt, overwrite or delete earlier downloads or copies already shared.
Troubleshooting
- The password is rejected as too short or too long
Protection accepts 8–127 UTF-8 bytes. Characters outside basic ASCII can use several bytes, so character count and byte count are not always the same.
Try this: Use a sufficiently long password that remains within the byte limit. The minimum is an input requirement, not a measure of whether a password is difficult to guess.
- The source is reported as already protected
This operation expects an unencrypted input; it does not silently replace existing encryption.
Try this: Use Unlock PDF with the known password, inspect the unlocked copy, then protect that copy with the new credentials and settings.
- Copying or printing is still possible after opening
Permission flags depend on the viewer, and the owner credential grants full access. Leaving Owner password blank makes the open password serve both roles.
Try this: Check which credential was used and test the intended viewer. Do not use these flags as a substitute for removing content the recipient must not receive.
- The engine cannot start or output verification fails
Browser feature support, available memory, file limits or an unsupported PDF can prevent the encryption and verification steps from completing.
Try this: Keep the source, check the displayed limits and retry in a supported browser with a smaller document if appropriate. Do not treat an error as a successful protection operation.
Limits and compatibility
- Security scope
- Encryption protects opening the exported file. It does not verify the recipient's identity, prevent screenshots, guarantee secrecy after password disclosure or create a digital signature.
- Password handling
- The local worker uses the passwords for the operation and the page clears its password fields afterward. There is no account, saved-password vault or recovery service in this workflow.
Your files and form values are processed on this device. Downloaded copies remain wherever you save them. See how to check local processing and our privacy policy for site data and optional services.
Common questions
- Can I recover a forgotten password through this site?
- No. Keep a secure record of the password and retain an appropriate original copy. The site cannot look up or recover a password used in a previous run.
- Does protecting the PDF remove sensitive text from it?
- No. The content is still present for anyone who can open the file. Use a reviewed redaction workflow first when specific information must be removed.
Continue your document workflow
Maintained by Shakti Prasad Ram. Found a mismatch? Report the tool, browser and steps without sending a sensitive document. Back to the tool