Skip to content
ToolMug

Use ↑ ↓ to move, Enter to open, Esc to close.

Protect PDF

Add a password to a PDF before sending contracts, reports or other sensitive files, or just restrict printing, copying and editing so the file can be read but not changed. Encryption is AES-256, done by qpdf in your browser — the file and password never leave your device.

Runs in your browser — nothing you enter is uploaded

or drop a file here

Anyone opening the PDF must enter it. Leave empty to only restrict permissions.

Needed to change the restrictions. A random one is made if you leave it empty.

Allow

Permissions are honoured by PDF readers such as Acrobat, Chrome and Preview, but some tools ignore them. Only the password to open actually encrypts the content.

How to use

  1. Choose or drop the PDF.
  2. Enter a password to open. Leave it empty if you only want to restrict permissions and let anyone view the file.
  3. Tick what to allow (printing, copying, editing, comments). Enter a permissions password or leave it empty to generate one.
  4. Click Protect PDF. The encrypted file downloads when it is done.

Options explained

Password to open
Encrypts all content with AES-256; without the password the PDF cannot be opened. Don't forget it — it cannot be recovered.
Permissions password
Needed to change or remove the restrictions. If left empty, a random one is generated and shown so you can keep it.
Restrictions
Limit printing, copying text and images, editing, and comments and form filling. With restrictions but no open password, software that ignores permissions can still read the content.

How the options map to the encryption settings

The file is encrypted with 256-bit AES (qpdf’s --bits=256). Each checkbox under Allow sets one permission:

Checkbox Ticked Unticked
Printing --print=full --print=none
Copying text and images --extract=y --extract=n
Editing --modify=all --modify=annotate if Comments and form filling is ticked, otherwise --modify=none
Comments and form filling --annotate=y --annotate=n

Printing, Copying and Comments start ticked; Editing starts unticked. With those defaults, a password of secret and an automatically generated permissions password, the options are:

--encrypt --user-password=secret --owner-password=<generated> --bits=256
--print=full --extract=y --modify=annotate --annotate=y

The generated permissions password is 20 characters long and leaves out look-alike characters (l, I, O, 0 and 1). Copy it when it is shown so you can change the restrictions later. If the PDF is already encrypted you will see a warning; remove the existing password first.

Frequently asked questions

What can open an encrypted PDF?

Common PDF readers support AES-256, including Adobe Acrobat and Reader, web browsers, macOS Preview and mobile apps; only very old readers may fail to open it.

What's the difference between the two passwords?

The open password controls who can view the file. The permissions password controls printing, copying and editing, and changing those limits; opening with it grants full access.

Are my files uploaded?

No. Encryption runs in your browser; neither the file nor the password is sent to a server.

Privacy

This tool runs entirely in your browser. Your files and text are processed on your device and are never uploaded to our servers.

Related tools