Protect PDF

Encrypt a PDF with a password, and decide what readers may print, copy or change.

Secure server processingPDFWorkingNo account needed

What this tool does

Protect PDF writes a new, encrypted copy of your document using qpdf. Page content, embedded fonts and image streams are all encrypted, so a viewer will not display a single page until the open password is supplied. That is genuine encryption of the file's contents rather than a flag asking software to behave. AES-256 is the default, and it is the scheme the PDF 2.0 specification describes; the 128-bit option is there for readers too old to open an AES-256 file, and it is written as AES-128 — not the RC4 cipher that a 128-bit setting meant in older software. Both options are AES, so the 128-bit one is weaker only in key length, and qpdf will not write RC4 at all.

The permission checkboxes are a different thing, and the difference is worth being clear about. Allow printing, allow copying text, allow editing, and allow annotations and form filling are recorded in the document's encryption dictionary, and conforming readers obey them. They are not a technical barrier: anyone holding the open password can write the file out again without the restrictions. A separate owner password is what makes them mean anything, and leaving that field blank sets the owner password to the same value as the open password — which hands every recipient the ability to lift the limits you just set.

The work happens on the server. Your PDF is uploaded over an encrypted connection to a machine running qpdf, and the upload, the returned file and the job record are all deleted together once the retention window passes. The password is not part of what waits for that deletion: the settings written to the database record it as redacted, and the real value travels in the queue payload alone, which is cleared as soon as the job finishes. Either password can stand on its own. Give a password to open the document and the contents are encrypted; leave that blank and give an owner password instead, and the file opens for anyone while still carrying the permission flags — a permissions-only document. Only both fields blank is refused, because a PDF encrypted with no password at all protects nothing. A document that already asks for a password has to go through Unlock PDF before it can be re-encrypted here.

How to use it

  1. Choose the PDF. One document per job, within the 200 MB upload ceiling. A file that already demands a password cannot be read, so remove that password with Unlock PDF first.
  2. Set the password to open the document. Up to 100 characters, or leave it blank if you only want the permission flags. It travels with the job over the encrypted connection and is never written to the database — the stored settings show it as redacted, and the real value is dropped from the queue when the job ends. Nothing here reads it back to you.
  3. Add an owner password if the restrictions matter. Left blank, it is set to the open password, and anyone who can open the file can also strip the permissions you chose. With no open password set, this field is what the job runs on, and leaving both blank is refused.
  4. Choose the encryption and the permissions. AES-256 unless an older viewer forces the 128-bit alternative. Printing and annotations are permitted by default; copying text and editing are not.

Processing & privacy

Secure server processing. This operation requires temporary server processing.

Common use cases

Emailing a payslip or a bank statement

Mail sits on servers you do not control. A password on the attachment means an exposed mailbox is not automatically an exposed document.

Circulating a draft for comment

Leave annotations allowed and editing blocked, so reviewers can mark up their copy without quietly rewriting the text everyone else is reading.

Sending a tender or an exam paper

The recipient can read and print it, while copying text is switched off, so the contents are not lifted into another document without effort.

Archiving scanned records

One password across a set of scans means a mislaid laptop or an over-shared drive is not a readable filing cabinet.

Questions

Is my PDF uploaded?
Yes. Encryption runs through qpdf on the server, so the document is sent over an encrypted connection, processed there, and deleted automatically when the short retention window expires. Tools that need no upload at all, such as Merge PDF, are marked as running in the browser.
Can I set permissions without a password?
Yes. Leave the open password blank and fill in an owner password: the document opens for anyone, with the permission flags attached to it. Be clear about what that buys — the file is readable by everyone who receives it, and the flags are a request to the reader, not a lock. Only leaving both password fields blank is refused.
Do the permission settings actually stop anyone?
They stop conforming readers, which covers ordinary use: the viewer greys out printing, or declines a copy. They do not stop someone determined, because the same class of tool that writes those flags can remove them once the file is open. The encryption is the part that holds; the flags are a request.
Which encryption strength should I choose?
AES-256, unless a specific old reader cannot open the result. The 128-bit alternative exists for those viewers and is written as AES-128, the same cipher with a shorter key — not the RC4 that a 128-bit setting implied in older software, which qpdf now refuses to write. Take it only when the stronger one will not open.
Can I lock a PDF that is already password-protected?
Not directly. The document has to be readable before it can be re-encrypted, so run Unlock PDF first using the password you hold, then protect the result.
What happens if I forget the password?
Nothing here can recover it, and that is not a limitation we could lift — no copy of it is kept. There is no reset, and no part of the site reads it back, so treat what you set as the only copy and keep it somewhere you trust.
What happens to the password I type?
It is kept out of the stored job settings, which record it as redacted, and exists only in the queue payload the worker hands to qpdf. That payload is cleared the moment the job finishes, so the password is gone well before the file and the job record are deleted at expiry. It is never logged, never shown in the admin view, and a job whose password has gone cannot be re-run from the inside — the retry is refused rather than quietly encrypting something with the wrong value.
Does this hide anything inside the file?
No. Once the password is entered the document is intact, including any text you would rather nobody read. Removing content is a different job — Redact PDF destroys the text instead of putting a lock in front of it.

Related tools

  • Merge PDF — Combine several PDFs into one document in the order you choose.
  • Split PDF — Split one PDF into separate documents by page range.
  • Compress PDF — Reduce PDF file size while preserving the quality that matters.
  • PDF to JPG — Export every page of a PDF as a JPG image.
  • JPG to PDF — Turn one or many JPG photos into a single PDF.
  • Sign PDF — Draw, type or upload a signature and place it on the page.