How to Password Protect a PDF

Password-protecting a PDF means adding encryption so the file cannot be opened (or, optionally, edited, printed, or copied from) without a password. The protection is applied by a PDF writer that encrypts the content streams and stores the encryption key in a dictionary that can only be unlocked with the password. This guide covers what the two kinds of PDF password actually do, which encryption algorithm to prefer, and which tools do this locally — without uploading your document.

The two PDF passwords: user vs owner

A PDF can carry two separate passwords, and confusing them is the most common mistake people make when protecting a file.

• User password (open password). Required to open the file at all. Without it, the document cannot be decrypted and no viewer can render a single page. This is what most people mean by "password protect a PDF."
• Owner password (permissions password). Required tochange the restrictions on the file — printing, copying text, editing, or filling forms. A viewer may still open the document without this password if a user password is not set, but it must enforce the restrictions the owner chose.

In practice: if you want to stop someone from opening the file, set a user password. If you want to let anyone read it but stop them from printing or copying, set only an owner password with the desired restrictions. Setting both is fine and is the most locked-down option.

RC4 vs AES: which encryption is used?

PDF supports several encryption algorithms. The one your tool picks matters a lot for how strong the protection actually is.

• RC4 (PDF 1.2–1.5). A stream cipher once popular in PDF and SSL. It is now deprecated and considered broken for modern security use. Files encrypted with 40-bit or 128-bit RC4 should be treated as weakly protected. Avoid creating new RC4-encrypted PDFs.
• AES-128 (PDF 1.5, Acrobat 7). Advanced Encryption Standard with a 128-bit key. Solid and widely supported. A reasonable default when AES-256 is not available.
• AES-256 (PDF 1.6 / Extension Level 3, Acrobat 9).AES with a 256-bit key. The strongest standard PDF encryption available. Prefer this whenever your tool offers it.

For a deeper technical comparison, seePDF Encryption Explained.

Three tools that password-protect a PDF locally

Every option below runs on your machine. None of them upload your document. That matters: a PDF containing a contract, a medical record, or a tax form should not be sent to a random "free PDF encryptor" website before it is protected — at that point the unprotected file is already on someone else's server.

1. Adobe Acrobat Pro (paid)

The most full-featured option. Open the PDF, thenFile > Protect Using Password. ChooseEncrypt with Password, set a user password, and underAdvanced Options pick AES-256. Acrobat Pro also lets you set owner-password restrictions (no printing, no editing) in the same dialog. Acrobat Standard and the free Adobe Reader cannot add encryption — only Pro can.

2. Preview (macOS, free)

Open the PDF in Preview, then File > Export…, tickEncrypt, and enter a password. Preview uses AES-128 on recent macOS versions. This is the simplest free option on a Mac and works well for files that need a user password only. Preview does not expose granular owner-password restrictions.

3. qpdf (command line, free, cross-platform)

qpdf --encrypt "userpw" "ownerpw" 256 -- input.pdf output.pdfproduces an AES-256 encrypted PDF. qpdf is open source, fast, and scriptable — useful if you need to protect many files or want a reproducible build step. It supports both 128-bit and 256-bit AES.

Step-by-step: protect a PDF with Preview (macOS)

1. Open the PDF in Preview.
2. Choose File > Export… from the menu.
3. In the export dialog, tick Encrypt.
4. Enter a strong password and verify it.
5. Click Save. Reopen the new file to confirm it prompts for the password.

Strong passwords and recovery

PDF encryption has no password recovery mechanism. If you lose the user password, the file is gone — there is no "forgot password" email flow because there is no server. Use a password manager. A 16-character random password stored in your manager is both stronger than anything you can memorize and impossible to forget.

Avoid passwords based on document contents (a name, a date, a project code that appears inside the PDF). Anyone who can guess the password from the document's context can open the file.

Common mistakes

• Setting only an owner password and expecting the file to be unreadable. Without a user password the document still opens; only the restrictions apply.
• Using a "free online PDF encryptor" for a sensitive file. The file is uploaded unencrypted before the protection is applied. Use a local tool instead.
• Accepting RC4 as the default. Some older tools default to 40-bit or 128-bit RC4. Check the encryption settings and switch to AES-128 or AES-256.
• Forgetting the password. There is no recovery. Store it in a password manager at the moment you set it.