How to Password Protect a PDF — Free, In Your Browser (2026)

You need to email a signed contract, a tax return, or a medical record, and you do not want anyone who intercepts the file — or grabs the wrong laptop — to read it. Password protecting the PDF encrypts the contents so only someone with the password can open it. The catch that trips people up: most "protect PDF online" tools upload your sensitive file to a stranger's server to do the encrypting. This guide shows you how to add strong AES-256 encryption without that risk, plus exactly how the built-in options on Mac and Windows compare.

1. Quick Answer

2. Why Password Protect a PDF

A PDF is a container that travels — over email, through shared drives, onto USB sticks, into cloud folders. Every one of those hops is a place the file can end up somewhere you did not intend. Encryption is what makes the file useless to anyone who gets it without the password.

The documents people most often protect are the ones with real consequences if they leak:

• Financial documents — tax returns, bank statements, pay stubs, invoices with account numbers.
• Legal and HR files — signed contracts, NDAs, offer letters, settlement agreements.
• Medical records — lab results, prescriptions, and anything covered by HIPAA-style confidentiality expectations.
• Identity documents — scans of passports, driver's licenses, and government forms.
• Business material under compliance rules — GDPR, HIPAA, SOC 2, and similar frameworks all expect sensitive data to be encrypted "at rest" and "in transit." A password-protected PDF is one of the simplest ways to satisfy that for a single document you are about to send.

Encrypting the file at the source means it stays protected wherever it travels afterward — the recipient needs the password to open it, and so does anyone who intercepts it in between.

3. Open Password vs Owner Password

The PDF standard supports two completely different kinds of password, and confusing them is the most common security mistake people make. They protect against different things.

A single PDF can carry an open password, an owner password, both, or neither. The important distinction: an open password gives you genuine security because the content is encrypted and unreadable without the key. An owner-password-only file is far weaker — because the document itself is not encrypted, many PDF readers and command-line tools can simply ignore the permission flags and print or copy anyway. If your goal is to keep the contents private, you want an open password. That is what Convertlo's Protect PDF tool adds.

4. What AES-256 Means for Your PDF

AES-256 is the Advanced Encryption Standard using a 256-bit key. It is the encryption defined for modern PDFs in the PDF 2.0 (ISO 32000-2) specification, and it is the same class of encryption trusted by banks, governments, and password managers.

Here is what happens at a high level when you set an open password:

1. Your password is run through a key-derivation step that turns the text you typed into a fixed-length encryption key.
2. That key is used to encrypt the streams inside the PDF — the text, images, and fonts that make up the actual content.
3. When someone opens the file and enters the correct password, the reader re-derives the key and decrypts the content on the fly. An incorrect password derives the wrong key, and the data stays scrambled.

Older PDFs used RC4 or 128-bit encryption, both of which are now considered weak — RC4 in particular has known cryptographic flaws. AES-256 has no known practical brute-force break when it is implemented correctly. That is worth sitting with for a second: the algorithm is essentially never the weak link. Your password is. A 256-bit key is unbreakable by brute force, but a password like summer2024 can be guessed by a dictionary attack in seconds regardless of how strong the underlying cipher is.

5. Password Protect a PDF with Convertlo

Convertlo's Protect PDF tool runs qpdf compiled to WebAssembly directly in your browser. The encryption happens on your own machine — the PDF is read, encrypted, and re-saved locally, and neither the file nor the password is ever transmitted to or stored on any server. That is a real, structural privacy advantage over upload-based tools, and it is exactly what you want for sensitive documents.

6. Every Method Compared

Four common ways to add a password to a PDF, and how they stack up on the two things that matter most: how strong the encryption is, and whether your file is uploaded.

A few notes on each:

• Convertlo is the only option that needs nothing installed and keeps the file on your device. It is the practical choice on a locked-down work computer, a Chromebook, or a phone.
• macOS Preview is excellent if you are on a Mac — it is built in and offline — but Apple's implementation uses AES-128 rather than 256. Still strong, just a notch below the modern standard.
• Microsoft Word applies AES-256 through File → Save As → PDF → Options → "Encrypt the document with a password." It only works if the source is (or can become) a Word document, and you need Word installed.
• Adobe Acrobat is powerful and gives you fine-grained control over both open and owner passwords, but the encryption features live in the paid Acrobat Pro tier, which is overkill for occasionally locking one file.

7. How to Choose a Strong Password

Because AES-256 itself cannot realistically be brute-forced, the entire security of your protected PDF rests on the password. Treat it accordingly:

• Length beats complexity. A long passphrase like river-copper-lantern-89 is far harder to crack than a short scramble like P@w7!, and much easier to type. Aim for 16 characters or more.
• Make it unique. Do not reuse a password you already use for email or banking. If the PDF's password leaks, you do not want it unlocking anything else.
• Avoid the obvious. Names, birthdays, 123456, the company name, and password1 are the first things a dictionary attack tries.
• Do not send the password with the file. Email the protected PDF, then share the password through a different channel — a text message, a phone call, or a password manager's secure-share link.

8. There Is No Recovery — Save the Password

This is the single most important thing to understand about strong PDF encryption, and it is a direct consequence of the encryption actually working. The same property that stops an attacker from opening your file also stops you from opening it if you lose the password. There is a meaningful difference here between the two password types: an owner (permissions) password can often be stripped because the file is not encrypted, but a forgotten open password on an AES-256 file is unrecoverable by design.

Already locked out of a file — or received a protected PDF whose password you legitimately know and want to remove? Use Convertlo's Unlock PDF tool, which removes the password (when you can supply it) in the browser, the same private way it adds one.

9. Frequently Asked Questions

Locking a PDF is a one-minute task, but the details decide whether it is actually secure: use an open password for real encryption, pick AES-256, choose a long unique passphrase, and save that passphrase somewhere safe because it cannot be recovered. Do it in a tool that keeps the file on your device and you get bank-grade encryption without ever trusting a stranger's server.