How to Password Protect a PDF (and Choose a Password That Holds)

How to protect a PDF in your browser

1. Open Protect PDF and choose your file. It stays on your device.
2. Type a password and repeat it. The strength meter shows how strong it is.
3. Set the permissions: allow or block printing, copying text, and editing.
4. Optionally enter a separate owner password. If you leave it empty, the tool uses the same password for both.
5. Click Protect PDF and download the encrypted file.
6. Open the downloaded file to confirm it asks for the password.

Do any other work on the document before this step. Compress, merge, sign, watermark and number pages first, because most tools can't edit an encrypted file without unlocking it.

Choosing a password that holds

Encryption is only as strong as the password. AES-256 can't be broken directly, so attackers try passwords instead. Free tools can test millions of guesses per second against a PDF on an ordinary computer, and far more on rented cloud hardware. They start with the most likely candidates: common passwords, dictionary words, names, dates, keyboard patterns and leaked password lists.

That makes some passwords almost worthless, no matter what encryption sits behind them:

• 123456, password, qwerty
• birth dates such as 12031988
• names plus years such as Maria2024
• the company name, the client's name or the document title

Banks often protect statements with your birth date or part of your ID number. That's convenient for you, and also easy for anyone who knows a bit about you.

What a strong password looks like

Length beats complexity. A long passphrase of random words is easier to type and harder to crack than a short jumble of symbols.

Password	Rough strength
Maria2024!	weak, follows a common pattern
x7#Qp2	weak, too short
Tr0ub4dor&3	moderate, short and predictable substitutions
lamp-orbit-cactus-river	strong, four random words
lamp-orbit-cactus-river-velvet	very strong

The key word is random. "my-dog-loves-walks" is four words but a guessable phrase. Pick words with a dice-based method or a password manager's generator.

Aim for at least 12 characters, or four or more random words. For highly sensitive files, use five words or more.

Sharing the password without undoing the protection

Here's the mistake that defeats most PDF protection: sending the password in the same email as the file. Anyone who gets the email gets both.

Send the password through a different channel:

• a text message or chat app (WhatsApp, Signal)
• a phone call
• an agreed password that the recipient already knows
• a password manager's secure sharing feature

For recurring exchanges with the same person, agree on a password once, in person or by phone, and reuse it for that relationship only.

If you have to send both by email, at least send them in separate messages, hours apart. It's weaker, but better than one message.

What permissions can and can't do

Permissions sound powerful: block printing, block copying, block editing. In practice they're a polite request.

When you open a PDF with the user password, the reader decrypts the content so it can display it. At that point the reader has everything. Mainstream readers such as Adobe Acrobat, Chrome, Edge, Firefox and Preview respect the permission flags and grey out the blocked actions. But free tools exist that ignore the flags, and anyone can take screenshots or photograph the screen.

So:

• Use the open password to keep people out. That's real protection.
• Use permissions to discourage casual copying and printing by people you've already given access to. Don't rely on them for secrecy.
• Don't use owner-only protection for confidential documents. A file that opens without a password is readable by anyone.

If you need to discourage sharing among people who can open the file, add a visible watermark with their name using Watermark PDF. A leaked copy then points back to its source.

Removing a password

When you receive protected PDFs regularly, typing the password each time gets old, and protected files can't be merged or compressed. If you know the password and have the right to the file, Unlock PDF removes it. You type the password once, and you get a copy that opens without one.

Unlock only what you own or have permission to change. And remember that the unlocked copy is no longer protected. Store it somewhere safe, and delete it when you're done.

Files restricted only by an owner password (they open freely but block printing) can be unlocked without any password, which again shows how little owner-only protection achieves.

What protection doesn't cover

Password protection keeps the content of the file private in transit and at rest. It doesn't do everything:

• It doesn't hide the file name. Smith-divorce-settlement.pdf reveals a lot even if the content is encrypted. Use neutral names.
• It may not hide metadata. Depending on the tool, the title and author may remain readable without the password. Strip them first with Sanitize PDF if they're sensitive.
• It doesn't stop the recipient from sharing. Once they can open it, they can forward the file and the password, or print it.
• It doesn't protect the copy on your own computer. If your laptop isn't encrypted, the unprotected original is still sitting on it.
• It can't be undone if you forget the password. Nobody can recover a strong AES-256 password. Not us, not Adobe, not a recovery service. Store it in a password manager.

A safe routine for sending sensitive PDFs

1. Finish all edits: merge, compress, sign, number pages.
2. Sanitize to remove hidden metadata, comments and attachments you don't intend to send.
3. Rename the file to something neutral.
4. Protect with a strong passphrase and AES-256.
5. Test that the file asks for the password and opens with it.
6. Send the file by email.
7. Send the password by text, chat or phone.
8. Delete intermediate copies from your Downloads folder.

That's a few minutes of work for a document that stays private even if the email goes astray.

How long would it take to crack?

Estimates depend on the attacker's hardware, but the shape of the numbers is what matters. Assume an attacker who can test 100 million guesses per second against a PDF, which is realistic for a few rented graphics cards working on older encryption and generous for AES-256.

Password type	Possible combinations	Time to try them all
6 digits (a date like 120388)	1 million	well under a second
8 lowercase letters	209 billion	about 35 minutes
8 characters, mixed case, digits, symbols	about 6 quadrillion	about 2 years
4 random words from a 7,776-word list	3.6 quadrillion	about 1 year
5 random words	28 quintillion	about 9,000 years
6 random words	221 sextillion	about 70 million years

Two lessons stand out. First, anything based on dates or short numbers falls instantly, whatever the encryption. Second, each extra random word multiplies the work by thousands. Five or six words put a file beyond any realistic attack, and they're still easy to type.

Attackers rarely try every combination. They start with leaked password lists and common patterns, which is why a password that "looks complex" but follows a human pattern (Summer2026!) falls far sooner than the table suggests. Randomness is what makes the numbers hold.

A simple policy for small teams

If you run a small office or a freelance practice, a few written rules prevent most mistakes:

1. Any PDF containing personal, financial or medical data is password-protected before it leaves the company.
2. Passwords are at least four random words, generated by the team's password manager.
3. Passwords never travel in the same channel as the file.
4. Each client or recipient gets their own password; never reuse one across clients.
5. Unlocked working copies are deleted when the job is finished.

Post them where people can see them. A rule people remember beats a perfect policy nobody reads.

Alternatives worth knowing

Password-protected PDFs are simple and universal: any recipient can open them with free software. For some situations, other options suit better.

• Encrypted email such as S/MIME or PGP protects the whole message and attachments. It requires setup on both sides.
• Secure file-sharing services with expiring links and access logs suit large files and teams.
• Encrypted archives (7-Zip with AES-256) protect several files at once, though the recipient needs to know how to open them.
• Client portals run by your accountant, lawyer or bank are often the safest way to exchange their documents.

For a one-off document to a person who isn't technical, a protected PDF plus a password by text message is hard to beat.

Common questions

Can a protected PDF be cracked? With a weak password, yes, often in minutes. With a long random passphrase and AES-256, not in any practical time.

Will the recipient need special software? No. Every modern PDF reader, including the ones built into browsers and phones, opens AES-256 PDFs.

Can I protect a PDF on my phone? Yes. Browser tools work in mobile Safari and Chrome.

Does protecting a PDF make it larger? Slightly, by a few kilobytes for the encryption data.

Can I protect only some pages? No. PDF encryption applies to the whole file. Split the document if you need different protection for different parts.

Summary

Protect sensitive PDFs with an open password and AES-256 encryption. Use a long random passphrase, send it through a different channel from the file, and treat permissions as a courtesy rather than a lock. Do all your edits first, strip hidden data, name the file neutrally and keep the password in a password manager. With those habits, your documents stay private wherever the email ends up.