How to Password Protect a PDF (Free, AES-256)

A PDF password here is an open password: without it, the file will not open at all. The content is encrypted, so the password is the key, not a polite request. This is different from an owner password, which only greys out printing or copying in a file that still opens freely, and which many viewers ignore. If you want real protection, you want the open password. Protect PDF sets exactly that and nothing else, using AES-256, the strongest encryption the PDF format supports. It deliberately does not offer print or copy restrictions, because they are not security. If you later need to take the password off, the guide to [removing a password from a PDF](/blog/how-to-remove-password-from-a-pdf) explains both password types and the reverse process in detail.

Open the [Protect PDF tool](/protect-pdf), drop in your file, type a password twice and click Protect PDF. Then download the locked copy. The steps: 1) Drag the PDF onto the page or click to browse. 2) Enter a password and confirm it; the tool shows an error if the two do not match, so a typo cannot lock you out of your own file. 3) Click Protect PDF and wait for the progress bar. 4) Download the result, which is saved with "-protected" added to the original name, so your original stays untouched. Everything runs in your browser tab, so neither the file nor the password is uploaded. Pages, text and images are kept as they were, and text stays selectable once the file is opened with the password.

Passwords are capped at 127 bytes, and this is a property of the PDF format, not an arbitrary tool limit. AES-256 PDF encryption (revision 6) only reads the first 127 UTF-8 bytes of a password, so anything longer would be silently truncated and the file could fail to open with what you typed. Protect PDF blocks that case up front with a clear message instead. For plain English letters and digits, one character is one byte, so 127 characters is plenty. The catch is non-Latin text and emoji: accented letters, Chinese or Arabic characters and emoji take two to four bytes each, so a short password in those scripts can hit the cap sooner than you expect. A long passphrase of ordinary words is a strong choice within the limit.

A PDF that already has a password cannot be locked again directly. The tool stops and tells you to remove the existing password with [Unlock PDF](/unlock-pdf) first, then protect the file again with the new one. A damaged file or a non-PDF renamed to .pdf gets a separate plain message that it could not be read, rather than raw engine output. There is also a safety check you will not see on most sites: after encrypting, the tool reopens the result with your password and confirms it really is AES-256 before offering the download. If that check fails, you get an error and no file, instead of a PDF that looks protected but is not. Use this tool last in your workflow.

Lock the PDF as the final step, because an encrypted file cannot be fed into other PDF tools. Protect PDF's own follow-up suggestions offer only Unlock for this reason: tools such as signing or compressing cannot open a password-protected file. So do the work first: [sign the document](/blog/how-to-sign-a-pdf), [shrink the file size](/blog/how-to-compress-a-pdf), and, if you are hiding anything, [permanently redact it](/blog/how-to-permanently-redact-a-pdf) before encrypting, since a password protects the file in transit but does not remove sensitive text from a copy you share with the password. Keep an unprotected original too. The tool never sees your password, so a forgotten one cannot be recovered.

On a Mac, Preview can do this without any extra tool. Open the PDF, choose File, then Export, tick Encrypt, enter a password and save. This creates a new file, so you can keep the original. In Adobe Acrobat Pro, the Protect tools include an option to encrypt with a password; menu names vary between versions, so look under Protect. Both need installed software, and Acrobat Pro is a paid subscription. We have not tested how either one's output behaves compared with ours, so we make no claims about their encryption strength or compatibility. Protect PDF's output was checked with the pdf.js viewer used by Firefox and with qpdf, and has not been tested in Acrobat or Preview.

Send the password through a different channel from the file. If a locked PDF and its password travel in the same email, anyone who reads that inbox has both. Use a phone call, a text message or a password manager share instead. Pick a long passphrase rather than a short complicated one, since how hard the file is to crack depends on the password you choose, not on the encryption alone. Recipients need a current PDF viewer; AES-256 is the standard PDF encryption, but very old viewers that predate it may not open the file. If the person on the other end cannot open it, send them to the guide on [removing a PDF password](/blog/how-to-remove-password-from-a-pdf) once you have shared the password.