PDF · runs locally
Password-protect a PDF
Real AES-256 or RC4 encryption, plus the permission switches PDF readers understand.
- 1Drop the PDF
The file is read into this tab; nothing is uploaded.
- 2Set passwords and permissions
Choose an open password, an owner password, and which actions readers should allow.
- 3Encrypt and download
You get a new PDF. Keep the password somewhere safe — there is no recovery.
What this tool does
Encryption is performed by the vendored @pdfsmaller/pdf-encrypt library (MIT), using AES-256 (PDF 2.0, revision 6) by default or RC4 128-bit for older readers. The PDF never leaves your device.
An empty open password produces a file that opens without a prompt but still declares permissions. That is useful for marking a document as read-only, not for keeping its contents secret.
Questions people actually ask
Can the password be recovered?
No. This tool does not store it and cannot crack it. If you lose the password, the file is gone.
Do permissions really stop editing?
PDF permissions are advisory. Conforming readers honour them, but a determined person with the right tool can ignore them. Use an open password when confidentiality matters.
Why does AES-256 need HTTPS?
AES-256 uses the browser's Web Crypto API, which browsers expose only in a secure context. The published HTTPS site and localhost qualify; plain HTTP does not. RC4 is available as a compatibility fallback.
Can I protect a PDF that is already locked?
No. Unlock it first with the password, then protect the unlocked copy.