Protect a PDF with a password
Lock a PDF before you send it: AES-256 encryption with the password you choose, written by qpdf on your device. The password is never stored or sent.
Updated October 30, 2026
Options
Type an open password or untick a permission: as it is, there is nothing to protect.
How it works
- Drop one or more PDFs anywhere on this page.
- Type an open password and choose what readers may do: print, copy, edit, comment.
- Press Protect PDF and download the encrypted copy.
When a password is the right protection
Use an open password for documents that would hurt if they went astray: payslips, contracts, medical reports, ID scans, tax forms sent by email. The file is encrypted with AES-256 on your device, and whoever receives it needs the password to see anything at all, in any PDF reader, on any phone. Send the password by another channel than the file, a message or a call rather than the same email, and prefer a phrase of several words over a short code.
Restrictions without a password
Sometimes the file should open freely but not be printed, copied or edited: a price list, a draft, a form you want filled but not altered. Leave the open password empty and untick the permissions. Readers follow these flags, but they are a request to the software, not a lock: anyone with the owner password, and some programs, can lift them. Treat them as a polite fence; treat the open password as the wall.
Batches and things to know
Up to 20 PDFs of up to 200 MB each can be protected in one run with the same password and permissions, useful for a month of invoices. A password cannot start with a dash or an at sign, a limit of the PDF engine; put another character first. If the file already carried a certificate-based signature it will no longer validate, because the file is written anew; protect first, then sign. Nothing is uploaded: the file and the password stay with you.
Why people use it
Free, no account
Every tool is free, with no sign-up, no e-mail address and no limit on how often you use it.
Your files stay on your device
The browser opens the file and processes it in memory, on your device. Nothing is uploaded, so nothing can be kept, leaked or looked at.
No watermark
The result is yours as it is: no watermark, no branding, no trial version.
Any device
A phone, a tablet or a computer with a current browser is enough: no app to install, no software to update.
Works offline after the first visit
The browser keeps the pages and their engines, so a tool you have opened once keeps working without a connection.
Open-source engines
The code that does the work is open-source software, named on the Licences page, running as WebAssembly in your browser.
Why it is private
Everything you type or drop here is handled by your browser, on your device. Nothing is uploaded. To verify, open your browser's developer tools, go to the Network tab, and use the tool: you will see no request carrying your data.
While a file is being processed, the counter under the result shows the page's network traffic: 0 requests and 0 B for your data.
How to check it yourself, step by step
What you can check yourself
Open your browser's developer tools on the Network tab before you drop a file: while the tool works you will see no request carrying your data, and the counter under every result shows the page's own measurement.
The site sets no cookies, so there is no cookie banner. Anonymous usage counts and error reports without file names are the only things that leave the page, as the privacy policy describes.
Every change goes through thousands of automated tests in three browser engines, including a guard that fails a test if a single byte of a file leaves the page.
Frequently asked questions
- How strong is the protection?
- The file is encrypted with AES-256 (the method of PDF 2.0). With a long password nobody can open it without that password. A short or common password can be guessed offline, so the meter under the field gives a rough idea; a phrase of four or more words is safer.
- What do the permissions do?
- They tell PDF readers what to allow once the file is open: printing, copying text, editing pages, adding comments and filling forms. Most PDF readers and browsers respect them, but they are a request, not a lock on the content: some programs ignore them (Unlock PDF on this site removes them too). To keep a document secret, use an open password.
- What is the owner password?
- The password that lifts the restrictions. Leave it empty and a random one is made for this file and thrown away, so nobody, you included, can lift them later; type your own to keep that option. It should differ from the open password, or anyone who opens the file can change the permissions.
- Can you recover my password if I forget it?
- No. It is never stored or sent, and the encryption has no back door. Keep the password somewhere safe, or keep an unprotected copy.
- Is the PDF uploaded?
- No. qpdf runs in your browser as WebAssembly; the file and the password stay on your device. A digital signature in the file does not survive, because the file is written anew.
- Can I protect several PDFs with the same password?
- Yes, up to 20 per run. Every file gets the same open password, owner password and permissions, and each downloads separately.
- Can I add a password to a PDF on my phone?
- Yes, in the browser, no app needed. The encrypted copy lands in your downloads and opens in any PDF reader on the phone once the password is typed.
- Does the recipient need special software?
- No. Every PDF reader, browser and phone asks for the password and opens the file; AES-256 is part of the PDF standard.
- Can I make a PDF read-only but still allow printing?
- Yes. Keep Print ticked and untick Edit, Copy and Comment; set an owner password of your own if you may want to change this later.
- Can I remove the password later?
- Yes, with Unlock PDF on this site, as long as you know the password. Keep an unprotected copy somewhere safe anyway.
Install it as an app
Chrome, Edge and Android browsers offer to install this site from the address bar or the menu; on iPhone use Share, then Add to Home Screen. It opens like an app, keeps working offline and still processes everything on your device.