PDF tool
Password-protect a PDF
Add a password to a PDF using AES-256 encryption. This one runs in your browser for a specific reason: the alternative would mean sending us an unprotected document together with the password you want on it.
- 100% free
- No signup
- Never uploaded
Drop your files here
or click to browse from your device
Supports PDF · Max 50 MB per file · Up to 2,000 pages
Settings
Never leaves your browser. Write it down somewhere safe — there is no recovery, by design.
- Secure & privateYour files are never shared
- Lightning fastMost images in under a second
- High qualitymozjpeg and libvips under the hood
- Works everywhereAny device, any browser
Output quality
Encryption is done by qpdf compiled to WebAssembly, using AES-256 — the strongest scheme the PDF specification defines. Page content, fonts, images, bookmarks and form fields are preserved exactly; nothing is re-rendered or re-compressed, so the document looks and behaves identically once opened. The same password is set for both the user and owner roles on purpose: an owner password that differs from the user password produces only permission flags, which are advisory and widely ignored by readers, so presenting that as protection would be misleading. The file grows by roughly a kilobyte for the encryption dictionary. Note the honest boundary of what a password on a PDF achieves: it stops the file being opened, but anyone who does open it can copy the contents, and the strength rests entirely on the password you choose.
See what this tool actually did to real files — median size change, speed and sample size, published whichever way the numbers fall.
Privacy: this tool does not upload your file
The file is never sent anywhere
This tool is JavaScript running in your tab. Your document is read from your disk into browser memory and never transmitted — not to us, not to anyone. It handles files up to 50 MB and 2,000 pages.
You can check this yourself
Load this page, turn off your internet connection, and run the tool. It still works. That is not a promise about our conduct — it is something you can verify in ten seconds.
Nothing to delete afterwards
There is no upload, no job record and no copy on any server, so there is no retention period. Close the tab and the working copy is gone with it.
No third parties involved
The PDF engine and its fonts are served from this domain rather than a public CDN, so no outside company sees that you used this page, or when.
Input, output and limits
Every figure below is read from the same configuration the server enforces, so this page cannot promise a limit the system will refuse.
- Input formats
- application/pdf
- Output format
- application/pdf
- Maximum file size
- 50 MB per file
- Maximum pages
- 2,000 per run
- Multiple files
- Yes — several files at once
- Price
- Free, with no account and no watermark
- Processing
- Inside your browser — the file is never uploaded
- Engine
- pdf-lib, running inside your browser
- File retention
- None — nothing is uploaded, so there is nothing to keep or delete
Common use cases
Sending a contract or ID document by email
Mail is not private. A password on the attachment, shared through another channel, is a large step up.
Payslips and financial records
Encryption before the file goes into cloud storage or onto a shared drive.
Medical and legal paperwork
The document never leaves your machine to be protected, which is the whole point here.
Anything going onto a USB stick
A lost stick then loses nothing but the stick.
Settings you can change
Password to set
Never leaves your browser, and is not stored anywhere.
Never leaves your browser. Write it down somewhere safe — there is no recovery, by design.
Troubleshooting
- It says the file could not be locked
- The PDF probably already has a password. Remove that with Unlock PDF first, then set the new one.
- A colleague cannot open it on old software
- AES-256 needs a reader from roughly 2009 onwards. Almost everything qualifies, but very old corporate installs occasionally do not.
- I want to stop people copying the text
- PDF cannot enforce that. Copy-protection flags are advisory and readers may ignore them; only the open-password is real.
Something else went wrong? Tell us what happened — a person reads every report, and that is how this list gets longer.
Frequently asked questions
Browse pdf toolsDoes the file get uploaded?
No, and on this tool that matters more than on any other. Doing this server-side would mean you hand us the document while it is still unprotected AND the password you intend to protect it with — both halves at once. The encryption runs as WebAssembly in your tab instead. Load the page, disconnect from the internet, and it still works.
How strong is the encryption?
AES-256, which is the strongest the PDF specification defines. We do not offer the weaker 40-bit and 128-bit RC4 modes that qpdf still supports: 40-bit RC4 is breakable on a desktop computer in seconds, so offering it would be offering protection that does not protect.
What if I forget the password?
The document is not recoverable, and that is what real encryption means. There is no master key, no reset link, and no copy on our side to fall back on. Write it down somewhere before you close the tab.
Can I set separate viewing and editing passwords?
No, and deliberately. Setting a different "owner" password only creates permission flags that every PDF reader is free to ignore, and many do. That is a promise the format cannot keep, so we set one real password that actually controls opening the file.
Where does my file go when I use this tool?
Nowhere. This tool is JavaScript that runs inside your browser tab, so the file is read straight from your disk into memory on your own device and never sent to us. There is no upload, no job record and no copy to delete afterwards — close the tab and the working copy goes with it. You can confirm this yourself: load the page, disconnect from the internet, and the tool still works. It handles files up to 50 MB and 2,000 pages, and those limits come from what one browser tab can hold rather than from anything on our side.