How the PDF is locked
The tool opens your PDF in the browser with @cantoo/pdf-lib, an open-source PDF library (MIT licence), and encrypts every page's text, images and fonts with AES-256. This is the strongest password security in the PDF standard: security handler revision 6, defined in PDF 2.0 (ISO 32000-2). The key is derived from your password with many rounds of SHA-2 hashing, which makes every guess an attacker tries cost more work. The locked copy downloads as a new file with "-protected" added to the name; your original is not changed.
Two passwords, two jobs
| Password | What it does | On this page |
|---|---|---|
| Open password (user password) | Needed to see anything in the file. This is the real lock. | Required |
| Owner password | Lifts the print, copy and edit restrictions in readers that respect them. | Optional. Blank means a random one nobody knows. |
How the strength meter works
The meter estimates how many guesses a password would take. It counts the kinds of characters you use (26 lowercase letters, 26 capitals, 10 digits, 33 symbols), then:
Strength in bits = number of characters × log2(size of the character pool), less 15 bits for a run like "1234" or "qwer", and halved when it uses very few different characters (like "aaaa1111"). Very weak under 28, weak under 36, fair under 60, strong under 80, very strong at 80 or more. Common passwords such as "password1" always count as very weak.
Example: "plum tractor violin 41" has 22 characters from lowercase letters, digits and the space (a symbol), a pool of 26 + 10 + 33 = 69. That gives 22 × log2(69) = 22 × 6.11 = 134 bits: very strong, and much easier to type than "X7#qL9!" (7 × log2(95) = 46 bits, only fair). Length beats complexity.
Your password never leaves this page
Online "protect PDF" services usually upload the file and the password to their servers, which defeats the point for a tax return or a medical record. Here, both stay in your browser tab. The encryption code runs on your device, and the locked file is saved straight to your Downloads folder.
Sending a protected PDF
- Send the password separately from the file: a text message or a phone call if the PDF goes by email.
- Don't put the password in the file name or the email subject.
- Payroll, tax and HR documents are a common use: the recipient opens the file with the password you agreed on.
To take the password off again later, use Unlock PDF with the same password.
Questions people ask
What happens if I forget the password?
The PDF can't be opened, by you or by us. The password is not stored anywhere: it exists only in your head and inside the encryption of the file. AES-256 has no back door, and guessing a long password would take far longer than anyone could wait. Keep the unprotected original, or save the password in a password manager before you send the file.
How strong is the protection?
The file is encrypted with AES-256, the strongest method the PDF standard offers (security handler revision 6, from PDF 2.0). The weak point is the password, not the cipher. A random 15-character password or four unrelated words is out of reach of guessing; a pet's name or a birthday is not. The strength meter estimates this as you type.
Will the person I send it to be able to open it?
Yes, in any current reader: Adobe Acrobat Reader X (2010) or later, Chrome, Edge, Firefox and most phone PDF apps open AES-256 files and ask for the password. Send the password by a different route than the file, for example by text message or a phone call when the PDF goes by email.
Do the print and copy restrictions really stop people?
Only partly. Restrictions are a request that well-behaved readers such as Acrobat and Chrome honor, but anyone who can open the file could use a program that ignores them. The open password is the real protection: without it, nobody can read the content at all.
Is my PDF or password uploaded?
No. Encryption runs in your browser with open-source code. The file and the password stay on your device, and the locked copy is saved straight to your Downloads folder.
Can I protect a PDF that already has a password?
Not directly. Unlock it first with the Unlock PDF tool (you need its current password), then protect the unlocked copy with the new password.