How to password protect a PDF
How do I put a password on a PDF?
Save your favourite tools
Create a free iBuildPDF account to keep your favourite tools and find them quickly anytime.
Free account. The PDF tools themselves never need one.
Short answer
Add an open password, which encrypts the file so it cannot be read without it. The other kind — a permissions password — lets anyone open the document and merely asks their reader not to allow printing or copying. Readers are free to ignore that, and many do.
Two passwords, and only one of them is protection
This is the whole subject, and it is the part most guides skip.
Two passwords that do different jobs
- The open password. Without it the file cannot be read at all — the contents are encrypted.
- The permissions password. The file opens for anyone; it is printing, copying and editing that are marked as not allowed.
- Both can sit on one document, and they are not the same protection. Only the first keeps anybody out.
| Open password | Permissions password | |
|---|---|---|
| What it does | Encrypts the contents. The file is unreadable without the password. | Sets flags asking readers to disallow printing, copying or editing. |
| Who is kept out | Everyone who does not have it. | Nobody. The document opens for anyone. |
| Enforced by | Mathematics. | The politeness of whichever program opens it. |
| Use it when | The contents are confidential. | You want to signal intent — a draft not meant for distribution. |
If someone asks you to "password protect" a document they almost always mean the first. What a PDF password protects goes into what each one is actually worth.
Adding one
- Open Protect PDF and choose your file.
- Set an open password. Write it down somewhere before you finish — there is no recovery, by design.
- Download the encrypted copy. Your original is untouched.
- Send the password by a different channel from the file. A password in the same email as the attachment protects against nothing except an accident.
Removing one you already know is Unlock PDF, and only for documents you are entitled to open.
What makes the password worth having
Encryption strength is not usually the weak part. The password is.
A short password can be attacked offline: whoever has the file can try guesses as fast as their hardware allows, with nobody to notice or lock the account. There is no rate limit on a file sitting on a disk.
- Length beats cleverness. Four unrelated words are stronger and easier to type than
P@ssw0rd!. - Never reuse a password you use for an account. This one gets shared by its nature.
- Per document, not per person. One password for everything you send means the first recipient to leak it opens the rest.
When a password is the wrong tool
Encryption protects the file. It does nothing about what is inside it, and these three come up constantly:
- Something in the document should not be there at all. A password does not remove it — it locks a door in front of it. Redaction is the operation that takes the content out, and Redact PDF is the tool.
- The file carries a name, a path or a company in its metadata. That travels with an encrypted file too. See what PDF metadata contains.
- You want to know it has not been altered. That is a signature, not a password — how to sign a PDF.
And once it is encrypted, most tools can no longer touch it. Compress, merge and convert all need to read the file, so do that work first and encrypt last.
Tools this article covers
Sources
Primary documentation for the claims above.