How to Password-Protect a PDF: Complete Guide
Password-protecting a PDF is one of the most straightforward ways to prevent unauthorized access to a document. But "password protection" is not a single thing — there are different encryption standards, different password types, and some approaches that offer far weaker protection than they appear to.
Here is everything you need to know before locking your next PDF.
Two Types of PDF Passwords
The PDF specification supports two distinct password roles:
User password (open password): Required to open and read the document at all. Without it, the PDF cannot be viewed. This is the standard "lock" most people think of.
Owner password (permissions password): Does not prevent opening the document, but restricts what the reader can do — printing, copying text, editing, or adding annotations. The owner password controls these permissions.
A PDF can have one or both. If only an owner password is set, the document opens freely but actions are restricted. If a user password is set, anyone without it sees only an error when trying to open the file.
AES-128 vs. AES-256 Encryption
The strength of PDF encryption is determined by the algorithm used:
40-bit RC4 / 128-bit RC4: Legacy encryption, used in older PDF versions (1.3–1.5). Considered insecure by modern standards — do not rely on these for sensitive documents.
AES-128: Introduced in PDF 1.6. Solid for most use cases — no practical brute-force attack against AES-128 with a strong password exists today.
AES-256: Introduced in PDF 1.7 (Adobe Extension Level 3) and standard in PDF 2.0. The current gold standard. Recommended for any document you need to keep secure for years.
When in doubt, always choose AES-256 if your tool supports it.
How to Choose a Strong PDF Password
The encryption standard matters, but a weak password undermines any algorithm. Follow these principles:
A 20-character random password with AES-256 encryption is practically unbreakable with current technology. A 6-character word-based password with AES-256 can be cracked in minutes.
How to Share the Password Securely
Encrypting a PDF and then emailing the password in the same message defeats the purpose. Keep the document and the password in separate channels:
Never paste the password in the email subject line, in a document filename, or in an unencrypted note attached to the PDF.
How to Password-Protect a PDF With PDFree
PDFree makes it easy to apply strong encryption to any PDF — and the entire process happens locally in your browser, so the file itself is never uploaded to any server:
When Password Protection Is Not Enough
Password-protected PDFs are effective against casual access, but are not a substitute for:
If your threat model involves determined, technically sophisticated adversaries, consult a security professional rather than relying solely on PDF passwords.
Protect your sensitive documents today — visit the PDFree Protect tool and add AES-256 encryption in seconds, with no account or installation required.