Skip to content
HandfulTools

How to password-protect a PDF (and share the password safely)

Encrypt a PDF so only the right person can open it, choose a password that holds up, send it without leaking it, and remove it again later.

· 6 min read

To password-protect a PDF, you encrypt its contents so that a reader asks for a password before showing a single page. A payslip, a tax form or a scanned ID sent as a plain attachment can be read by anyone who ends up with the email; an encrypted file stays locked wherever it is forwarded, archived or backed up.

The quickest route here: open Protect PDF, drop the document, type the password twice, decide what the reader may do once the file is open — print, copy text and images, edit or fill forms — then click Protect PDF and download the encrypted copy. The file is encrypted with AES-256, the strongest standard PDF encryption, and it happens in your browser: neither the document nor the password is uploaded, and the password is not stored anywhere.

The ways to encrypt a PDF, and when each one makes sense

Method Good for Watch out for
A browser tool like this one Any device, an existing PDF, nothing to install The file must not already be encrypted
The program that produced the document (Word, LibreOffice) Files you are exporting to PDF anyway Only works at export time, not on a PDF you received
Built-in OS features One quick job on a Mac macOS only

On macOS, Preview can encrypt: open the PDF, choose File → Export as PDF, tick Encrypt and enter a password. On Windows there is no built-in way to add a password to an existing PDF — "Microsoft Print to PDF" has no security options — but Microsoft Word can produce one: File → Save As → PDF → Options → Encrypt the document with a password. LibreOffice does the same on any system through File → Export as PDF → Security → Set passwords. On iPhone and Android, built-in options vary by version and manufacturer, so a browser tool in Safari or Chrome is the predictable route.

Choose a password that holds up

Encryption is not the weak point — the password is. Someone who obtains the file can try passwords as fast as their computer allows, offline, with no rate limit to stop them.

  • Twelve characters or more, or a passphrase of four or five unrelated words (tulip-orbit-canvas-mild). Length matters more than punctuation.
  • Not a date of birth, a phone number, an invoice number or a customer reference that is printed inside the document itself.
  • Not a password you reuse elsewhere: this one will be typed into chat apps and read aloud on the phone.
  • The Password Generator produces both random strings and word-based passphrases; How to create a strong password explains what actually makes one hard to guess.

Send the password another way

Putting the password in the same email as the attachment defeats the purpose: one forwarded thread and both halves travel together. Send the PDF by email and the password by text message, by phone or through a messaging app. For documents you exchange regularly with the same person — monthly payslips, a client's invoices — agree one passphrase in person and reuse it for that channel only.

What permissions really do

"No printing" and "no copying" are instructions that standard readers respect; they are not encryption. The tool stores them behind a second, random permissions password, so the opening password alone cannot be used to change them, but anyone who can open the file can still photograph the screen or retype the text. Use permissions to prevent accidents, not to protect a secret. Only the open password decides who sees the content.

What this does to your file

  • The pages are untouched. Text, images and fonts are the same; only the file's encryption changes, so quality and layout are identical.
  • The size barely moves. Encryption adds a small fixed overhead, not a percentage.
  • Other tools stop working on it. An encrypted PDF cannot be merged, compressed, numbered or read page by page until it is decrypted — including by the tools on this site. Do that work first, protect last.
  • Previews go dark. Mail clients, cloud drives and file managers show a lock instead of a thumbnail, and desktop search no longer indexes the text.
  • Metadata still exists. Title, author and producing software live inside the encrypted file, so they are protected too — but they come back the moment the file is decrypted. If a name should not be in the document at all, clear it with Edit PDF Metadata before protecting.

Common problems, and what they mean

"This PDF is already protected." A file can carry only one encryption. Remove the current password with Unlock PDF — you need to know it — then protect the file again with the new one.

You forgot the password. The file cannot be opened, and no tool here can recover it: the password is never stored, and unlocking requires the correct one rather than guessing it. Keep the unprotected original, or store the password in a password manager.

The recipient cannot open it. AES-256 is the security handler introduced with Acrobat X and PDF 2.0. Current versions of Adobe Reader, Preview, Chrome, Edge and Firefox all open it, but software from before 2010, and some embedded PDF viewers in older printers or scanners, do not.

The attachment is blocked or flagged. Some mail gateways refuse encrypted attachments because their scanners cannot look inside them. If a filter rejects the file, share it through a file service and send the password separately instead.

The file is too big and cannot be compressed. Compress PDF, like every other tool, needs to read the pages. Compress or merge the document first, then protect the final version.

You still need to edit the document. Keep an unprotected master copy. Every future change means unlocking, editing and protecting again.

Questions people ask

How strong is AES-256 in practice? The encryption itself is not the part that gets broken; guessing a short or common password is. A four-word passphrase is far harder to guess than an eight-character mixture of symbols.

Is my password sent to a server? No. Encryption runs in your browser with qpdf compiled to WebAssembly. Neither the file nor the password leaves your device.

Can this tool open a protected file I received? Only if you know the password — Unlock PDF removes it once you type it. Cracking an unknown password is not something these tools attempt, by design.

Does protecting a PDF stop screenshots? No. Nothing that a reader can display can be prevented from being photographed. Encryption controls who opens the file, not what they do afterwards.

Can I protect a scanned document? Yes. Encryption works the same on scans; it makes no difference whether the pages hold text or images.

Is a password-protected PDF better than a password-protected ZIP? For a single document the PDF is simpler: the recipient opens it in any reader, with no extra software and no extracted copy left lying in a temporary folder.

Can I remove the password later? Yes — see How to remove a password from a PDF for the details.

Next steps

Tools used in this guide

← All guides