How to Password-Protect a PDF (and Open a Locked One)

PDFUpdated 2026-09-27

A password-protected PDF is the standard way to send a document that should not be readable by whoever happens to intercept it. This guide covers adding that protection, choosing a password that will actually hold up, and the honest answer to "I have a PDF I cannot open" — because that situation has a narrower set of options than most articles admit.

Two different things people call "a PDF password"

Confusion here causes most of the disagreement you will find online, so start with the distinction:

User password (also called the document open password) — required to open the file at all. Without it, the document does not decrypt. This is what the encrypt tool sets, and it is what people usually mean by "password-protected".

Owner password (also called the permissions password) — restricts printing, copying text, and editing. The document opens without any password, and the reader software is expected to enforce the restrictions.

That second category explains a common puzzle: you find a PDF that opens fine but refuses to let you copy text, and someone tells you it is "password protected". It has an owner password only. Because the restrictions are enforced by the reader rather than by encryption, different readers honor them differently — which is also why file properties can disagree about how protected a document really is.

Adding an open password

Open PDF Encrypt — one file, up to 100MB, processed in your browser.

Upload the PDF.
Enter the Open password you want to require.
Enter it again in the confirm field. The tool shows a password strength reading as you type.
Click Encrypt PDF.
Download the encrypted file.

A note the tool itself makes and that deserves repeating: if you lose this password, the file is gone. There is no reset, no recovery email, no support override in a correctly encrypted PDF. The password is the key, and the encryption is the protection.

Choosing a password that is worth the trouble

Length beats complexity. A five-word passphrase is both easier to type and far harder to attack than an eight-character mix of symbols. Aim for something long rather than something cryptic.
Store it in a password manager, not in the covering email. If the password travels in the same message as the file, the protection is decorative.
Send the password through a different channel than the file — the file by email, the password by chat or SMS. That is the whole point of the exercise.
Reuse nothing important. Documents get forwarded; do not hand out a password you use anywhere else.

What encryption is actually applied

PDF supports several encryption schemes, and the differences matter mostly for how much you should worry:

Scheme	Age	Practical status
RC4 40-bit	PDF 1.1	Trivially broken. Legacy files only.
RC4 128-bit	PDF 1.4	Weak by modern standards; brute-forceable with effort.
AES-128	PDF 1.6	Still reasonable.
AES-256	PDF 2.0 / modern readers	Current standard; not realistically breakable with a good password.

Modern browser-based tools use AES. The practical takeaway is not about the algorithm but about your password: with AES and a long passphrase, nobody is going to brute-force their way in. With RC4 40-bit, they might not need your password at all.

One compatibility caveat: very old readers may fail to open AES-256 files. If you are sending to someone on antique software, that is worth knowing before they write back confused.

Opening and editing a protected PDF you own

Once you have the password, the reliable route is to remove the protection and work with an unprotected copy. Open PDF Decrypt, upload the file, enter the document password, and download the unprotected version. The check happens in your browser; neither the file nor the password is uploaded.

If you only need to read the document, you do not need to decrypt it — type the password into any PDF reader and it opens. Decrypting is for the cases where you need to edit, merge, compress, or share without the password prompt.

Remember that the decrypted copy has no protection at all. If it needs to travel, either re-encrypt it or send it over a channel you trust.

When you cannot open a PDF

Be clear about which of these you are in:

It is your file and you have forgotten the password. Try the passwords you actually reuse, check the email it arrived with, and look for an unprotected original in your own storage — a surprising share of "locked" documents have a clean copy sitting next to them. Third-party recovery services exist and charge by the attempt: they run dictionary and brute-force attacks that work against short passwords and legacy RC4 encryption, and are effectively useless against AES-256 with a long passphrase. Be skeptical of anyone promising guaranteed results.

It is someone else's file. You need the password from whoever created it. Working around the protection on a document you do not own is not something this guide will walk you through, and depending on where you are and what the document is, it may be more than a technical question.

It opens but blocks printing or copying — an owner-password document. The restrictions are enforced by the reader, not by cryptography, which is why some tools ignore them and others respect them. If you have a legitimate need — printing a document you purchased, quoting from a report you are licensed to use — the dependable route is to ask the issuer for an unrestricted copy. For a document you control, re-export it from the source with the restrictions removed.

A short checklist before you send

Password delivered through a different channel than the file
Recipient's software confirmed to handle the encryption scheme
An unprotected master copy kept somewhere safe, in case you need the file again in ten years
File already compressed if size matters — encrypting a file you will later need to recompress means decrypting it first

How to merge and split PDF files — unlock before merging encrypted documents
How to reduce PDF file size — settle the final file before you lock it
PDF tools — merge, split, compress, encrypt, decrypt, rotate