How to Password-Protect a PDF (and What the Password Really Does)

By the ZypCRM editorial team · Updated 20 October 2026 · 4 min read

Adding a password to a PDF is one of the simplest ways to protect a document you have to email or upload: tax returns, payslips, medical letters, contracts, scans of ID. But PDF “protection” covers two very different features, and only one of them actually keeps people out. This guide explains the difference and shows how to protect a file properly.

Two kinds of PDF password

The open password (user password)

An open password encrypts the document. Without the password, the file is unreadable data – a viewer cannot show the pages, and the text cannot be extracted. This is real protection, and its strength depends on two things: the encryption method and the password you choose.

Permission restrictions (owner password)

Permission settings ask the PDF viewer to block certain actions, such as printing, copying text or editing. The file can still be opened by anyone. These restrictions rely on the viewer software choosing to honour them. Adobe Acrobat and most mainstream readers do, but many tools ignore them, and they can be removed easily.

Use permissions as a polite signal (“please don’t edit this”), never as security. If the content is confidential, it needs an open password.

The Protect PDF tool sets an open password and lets you add optional restrictions: Block printing, Block copying text and images and Block editing.

Why the encryption method matters

PDF has supported several encryption schemes over the years:

• RC4 40-bit (very old) can be broken in minutes on a home computer, regardless of the password.
• RC4 128-bit and AES-128 are better, but older.
• AES-256 is the modern standard (supported since Acrobat 9/X and in PDF 2.0) and is what Protect PDF uses.

With AES-256, the weak point is no longer the encryption – it is the password. Attackers who get a copy of the file can try passwords offline as fast as their hardware allows, without any lockout. A short or common password can fall quickly; a long, unpredictable one is effectively out of reach.

Choosing a strong password

• Length beats complexity. A passphrase of four or five random words (for example, cactus-violin-harbour-mint) is both stronger and easier to type than P@ssw0rd1.
• Avoid personal information: birthdays, phone numbers, names and postcodes are the first things guessed. Ironically, many banks protect statements with a date of birth – that protects against casual snooping, not a determined attacker.
• Don’t reuse a password from an email or bank account.
• Use a password manager to generate and store it, if you have one.

The tool requires at least 6 characters, but treat that as a minimum, not a target. For sensitive files, use 14 characters or more.

Step by step

1. Open Protect PDF and choose your file.
2. Type the password, then type it again to confirm. The tool warns you if the two don’t match.
3. Optionally tick the restrictions you want.
4. Press Protect PDF and download the encrypted copy.
5. Test it: open the downloaded file and make sure the password works, before you delete or move the original.

If the PDF already has a password, the tool asks you to unlock it first. That prevents accidental double-encryption and lets you change the password: unlock with the old one, then protect with the new one.

Order of operations

Encryption should be the last step. Merge, compress, add page numbers and sign first; then protect. Most tools cannot work on an encrypted PDF, and compressing after encryption would require decrypting anyway.

Sharing the password safely

The most common mistake is sending the password in the same email as the file. Anyone who gets the email – a mistyped address, a compromised mailbox, a forwarded thread – gets both.

Better options:

• send the password by a different channel (a text message, a phone call, a messaging app),
• agree a password in advance for regular exchanges, such as with an accountant,
• for very sensitive material, use a dedicated secure file-sharing service.

Removing a password

If you know the password and want an unprotected copy (for example, to merge a protected statement with other documents), use Unlock PDF. You type the password, and the tool saves a decrypted copy.

Unlock PDF does not crack or guess passwords. If you’ve lost the password to an AES-256 file, there is no shortcut – which is precisely why the protection works.

Limits worth knowing

• Protection only applies to that copy. Anyone who has the password can open the file and save, print or screenshot it.
• Restrictions are not enforced everywhere. As explained above, “no printing” or “no copying” can be bypassed by some software.
• File names and email subjects aren’t encrypted. A file called john-smith-medical-report.pdf reveals its contents even if the pages are locked. Use a neutral name.
• Metadata. The document title and author fields inside the PDF may be stored unencrypted in some files. If that matters, clear them before protecting.

Privacy of the tool itself

Many online PDF tools upload your file to a server to encrypt it, which means a stranger’s computer briefly holds your unencrypted document. Protect PDF runs inside your browser using the qpdf engine compiled to WebAssembly: the file and the password never leave your device.

Summary

• An open password with AES-256 gives real protection; permission restrictions do not.
• Use a long passphrase and send it separately from the file.
• Protect as the final step, and test the result before deleting the original.
• Use Unlock PDF to remove a password you know.