How to Password Protect a PDF (and Remove It Later)

You are about to email a payslip, a signed lease or a scan of your passport. If the message goes to the wrong address, or the mailbox is later compromised, the attachment is readable by anyone who finds it. A password on the PDF turns that attachment into unreadable data unless the person also has the password.

It is a small step, and it is worth understanding what it covers before you rely on it.

What PDF password protection is

PDF encryption comes in two kinds that are often confused:

• An open password (user password) that is required to open the file at all.
• A permissions password (owner password) that restricts actions such as printing or copying while the file remains openable.

For most people, "protect this PDF" means the first one: nobody can open or preview the file without the password. Protect PDF does this by applying the password to the document in your browser. Note that it sets the same value as both the opening password and the owner password.

How to add a password to a PDF

1. Open Protect PDF and make sure you are in the add-password mode.
2. Choose your PDF.
3. Enter a password. Use a long one: a passphrase from the Passphrase Generator or a random string from the Password Generator.
4. Run the tool and download the protected copy.
5. Test it. Open the new file; it should ask for the password. Keep the original until you have confirmed the protected one works.
6. Send the password through a different channel from the file, for example by message or phone.

How to remove a password

Switch the tool to the remove mode, select the encrypted PDF, enter its current password and download the unlocked copy. This is useful when you want to merge the file with others (see merge PDFs without uploading) or archive it without having to enter a password each time. It only works if you know the password.

Benefits

• Protection if the email goes astray. A wrong recipient or a breached mailbox gets an unreadable file.
• Works with any viewer. The recipient does not need special software, only a PDF reader that supports encrypted files, which includes browsers and phone apps.
• No account, no upload. Because the file is processed on your device, the unprotected version is never held by a third party.
• Simple to audit. The protected file is either asking for the password or it is not.

Where current tools fall short

If you search for "password protect PDF online", the most prominent results often work by uploading the file. That is awkward: to protect a sensitive document you first hand an unprotected copy to a server. Other limits to watch for:

• File size or page caps on the free tier.
• Sign-up before download.
• Output with a watermark or branding.
• Download links that expire.
• Unclear information on how long your original is kept.

Local processing sidesteps all of that, because there is nothing to retain.

What a password does not do

This is the part people get wrong.

• It does not hide parts of a page. Anyone with the password sees everything. If a document contains information the reader should never see, remove it first. Redact PDF draws opaque black boxes over regions, but note that it is a visual cover; it does not strip the underlying text, so do not treat it as a guarantee for highly sensitive content.
• It does not stop copying after opening. Screenshots, retyping and copy-and-paste are all possible for an authorised reader.
• It does not mark ownership. To make a copy traceable, add a visible mark with Watermark PDF.
• It does not protect weak passwords. A short word can be guessed by trying a list. The same principle applies as in AES-256 text encryption: the strength of the lock depends on the passphrase.
• It does not provide recovery. Lose the password and the file is effectively gone.

Everyday situations

• Sending financial documents to an accountant. Bank statements and tax forms protected with a password shared by phone.
• Rental applications. An ID and payslips merged into one file, protected, and sent to a letting agent.
• Medical paperwork. Scanned letters or test results shared with a family member.
• Client deliverables. A draft proposal protected until the contract is signed.
• Personal archives. Passport and insurance scans stored in a cloud folder with a password on each file.

Tips and mistakes to avoid

• Never put the password in the same email as the file. That defeats the purpose.
• Use a password manager. Store the password where you can find it in a year.
• Pick length over complexity. Four unrelated words beat "P@ssw0rd1".
• Do not reuse a password from your email or bank for a file you send to someone else.
• Keep an unprotected original in a safe place if you may need to edit it again. Editing an encrypted file requires removing the password first.
• Redact before you encrypt. Encrypting does not remove what should not have been in the file in the first place.
• Check the final file on a second device or viewer before you rely on it.

A short checklist before you send a protected PDF

Run through this each time you protect a document:

• Is every page something the reader is meant to see? If not, remove or redact first.
• Is the password long enough, ideally four or more random words?
• Have you tested opening the protected copy in a different viewer, for example a browser and a phone?
• Will the password travel by a different route from the file?
• Do you have the original stored somewhere safe, in case you need to edit it?

It takes under a minute, and it catches the mistakes that cause most problems: a file that cannot be opened by the recipient, or a password that ends up in the same email as the attachment.

Open passwords versus permissions: why people get surprised

PDF files can also carry permission flags, such as "do not allow printing" or "do not allow copying text". Some viewers respect them and some do not, and they are not a strong security measure. The flags are advisory instructions to well-behaved software. Only the open password actually encrypts the content so that it cannot be read without the key.

This is worth remembering if someone asks you to make a PDF "uneditable" or "uncopyable". A password stops outsiders from reading the file. It does not stop an authorised reader from taking screenshots or retyping a page, and it does not guarantee how a third-party viewer will treat permission flags. If you need a document to be a fixed record, a better route is to share it as a flattened PDF and keep your editable source separate.

What if the recipient says it will not open?

Start with the basics. Passwords are case-sensitive, and a trailing space copied from a chat message is a very common cause. Ask them to type it rather than paste, or paste it into a plain text box first and check it. If their viewer is very old it may not support modern encryption, in which case a current browser or any recent PDF reader will work. As a last step, protect the original again with a fresh password and send that.

Related reading

For the bigger picture of sharing sensitive files, read is it safe to upload confidential PDFs and strong passwords vs passphrases. To see how the browser handles this work without a server, read why client-side tools matter. More tools are on the security tools and PDF tools pages.