PDF Password Protector
Put a password on a PDF and decide what can be printed, copied, edited or annotated. Real encryption, done in the page.
Drop a PDF here
Nothing is uploaded. The file is encrypted in this page.
What a reader types to open the file. Leave blank for permission limits only.
Must differ from the open password. This is what enforces the switches below.
There is no recovery
The password never leaves this page and nothing is stored. A password you lose is a document you have lost.
Everything here runs on your device. Nothing you enter is uploaded or stored.
Encrypt a PDF with an open password, an owner password, or both, and choose which of printing, copying, editing and annotating the file will permit. The encryption is written into the document itself, so every PDF reader enforces it — the file is not wrapped, renamed or hidden behind anything.
How to use it
- Drop or choose the PDF you want to protect.
- Type the open password readers will need. Leave it blank for permission limits only.
- Type a different owner password. This is what enforces the permission switches.
- Untick anything you want blocked.
- Press Save to download the encrypted PDF.
Two passwords, two different jobs
Almost every problem people have with protected PDFs comes from not knowing there are two passwords. The open password — the spec calls it the user password — is a gate: without it the reader will not render a single page. The owner password is authority: a reader that is given the owner password ignores the permission flags entirely and grants full rights.
That is why the two must differ if the permissions are to hold. A reader decides which set of rights to apply by checking the password it was handed against both hashes stored in the file. If the two hashes came from the same string, every successful open authenticates as the owner, and printing restrictions you carefully ticked off simply do not apply. This tool refuses that combination and says why, rather than handing you a file that behaves nothing like the form you filled in.
What the encryption actually is
The file is encrypted with the standard security handler at revision 3: a 128-bit key derived from your password, the permission integer and the document’s own identifier, then a per-object key for every string and every stream in the document. Text, images, fonts, metadata — all of it becomes ciphertext. There is no wrapper and no separate archive; the PDF is still a PDF, and a reader with the password opens it normally.
RC4 is the cipher, which is what makes the result openable in every reader ever shipped. It is also, honestly, an old cipher. In practice that rarely matters, because the weak link is nearly always the password: no key length rescues a common word. The strength meter exists to make that trade-off visible before you commit. For material where the cryptography itself has to be strong, encrypt the file with a modern AES archive tool and send the PDF inside it.
The limits, stated plainly
Permission flags are honoured by convention, not enforced by mathematics. Once a document is open its pages are decrypted in memory, and software that chooses to ignore the flags can print or copy freely. The open password is the part with real teeth. Anyone without it has nothing but ciphertext.
A password you lose is a document you have lost. There is no recovery path, no reset, and nothing stored anywhere — the encryption happens in this page and the password never leaves your machine. Write it down somewhere you will still have it in a year.
Which setting for which situation
| You want | Open password | Owner password | Permissions |
|---|---|---|---|
| Only certain people can read it | Set it | Same or blank | Leave all on |
| Anyone can read, nobody can print | Blank | Set it | Untick printing |
| Client reads but cannot extract text | Set it | Set a different one | Untick copying |
| Sign-off copy nobody should edit | Optional | Set it | Untick editing |
Questions
What is the difference between the open password and the owner password?
The open password is what a reader types to see the document at all — without it the file will not display. The owner password grants full rights over a document that has already been opened, and it is what makes the permission switches mean anything. A file can have either, or both. Give a client the open password and keep the owner password, and they can read but not print; give nobody the open password and the file opens freely but still refuses to be copied.
How strong is the encryption?
The document is encrypted with 128-bit RC4, the standard security handler at revision 3, which every PDF reader made since 1999 supports. RC4 is old and has known weaknesses as a cipher, but for this purpose the practical limit is almost always your password rather than the algorithm — a 128-bit key behind a four-digit PIN is four digits of security. The strength reading on the page is there for that reason. If you need modern cryptography for genuinely sensitive material, encrypt the file itself with AES rather than relying on PDF permissions.
Why does it refuse to set permissions without an owner password?
Because the file would not behave the way you expect. Permission flags are only honoured while a reader believes it holds the user password rather than the owner password. If there is no owner password, or if it is the same string as the open password, then everyone who can open the document is authenticating as the owner and every reader grants them full rights. Producing that file silently would be worse than refusing it, so the tool explains the problem instead.
Can the permissions be bypassed?
Yes, and this is true of every tool that sets them. Permission flags are a request the reader software chooses to honour; the pages themselves are fully decrypted once the document is open. Any determined person with the right software can lift printing and copying restrictions. The open password is the part that genuinely holds — without it there is nothing to read. Treat permissions as a clear statement of intent, not as enforcement.
Last updated