How do I password protect a PDF for free without Acrobat?

Use a browser-based tool like this one: open Protect PDF, drop the file in, type a password twice and download the protected copy. It needs no account, no installation and no Acrobat subscription, and because the encryption runs inside the browser tab the document is never uploaded. The result is a standard encrypted PDF, so the person you send it to can open it in Acrobat, Preview, Chrome or any phone viewer - they just get a password prompt first.

Can a password-protected PDF be cracked?

Not the encryption itself. This tool writes AES-256, and there is no known practical attack against it - which is why the password is the part that matters. A short or common password can be guessed by software that tries millions of candidates, and that is the realistic threat, so length is what protects you: four unrelated words are far harder to guess than eight scrambled characters. What you should not trust is an old PDF using 40-bit or RC4 encryption, since those are genuinely broken and can be opened without the password.

What is the difference between protecting a PDF and restricting printing or copying?

Protecting encrypts the document, so it cannot be opened at all without the password. Restricting only sets flags asking readers not to print, copy or edit - the file still opens for anyone, and the flags are honoured voluntarily, so any tool can strip them in seconds. If your goal is that the wrong person cannot read the file, you need the open password. Restrictions are useful only as a polite signal to colleagues, never as security.

How to Password Protect a PDF

You are about to email a scanned passport, a payslip or a signed contract, and you would rather it did not sit readable in someone's inbox forever. Putting a password on the PDF is the right instinct. The confusing part is that the format offers two different passwords, they protect completely different things, and only one of them is real security. This guide covers which one you want, how to add it without uploading the document anywhere, and the one mistake that makes the whole exercise pointless.

The two passwords, and why only one matters

A PDF can carry a user password, also called the document open password, and an owner password, also called the permissions password. They are not two strengths of the same thing - they are different mechanisms.

The user password encrypts the document. Its text is what derives the encryption key, and the pages, fonts and images are genuinely scrambled with that key. Without it a reader shows a prompt and nothing else: no pages, no preview, no thumbnail in a file manager.
The owner password sets permission flags - do not print, do not copy text, do not edit. The file is not sealed. It opens for anybody, and the flags are a request that a well-behaved reader chooses to honour.

That difference decides everything. If you want a document that cannot be read by the wrong person, you want the user password - the one Protect PDF sets. Permission flags are deliberately not offered: any reader may ignore them, and any PDF tool can strip them in about a second, including this site's own Unlock PDF. A checkbox promising nobody can print your file would be decoration.

How to password protect a PDF

The whole thing takes under a minute and needs no account or installation:

Open the Protect PDF tool.
Drag your PDF onto the page, or click to choose it.
Type the password, then type it again to confirm. Tick Show password to read back what you typed - worth doing, because a typo here locks the file with a password you do not know.
Check the strength note underneath, then click Protect PDF and download.
Your browser saves the result as protected.pdf. Open it and confirm your reader asks for the password before it shows anything.

That last step is not a formality - it is the only check that proves the file is encrypted rather than merely marked. If the document opens straight to page one without asking, you have a restricted file, not a protected one.

Files that are already locked work too: you will be asked for the current password first, since the document has to be opened before it can be re-sealed, and the copy you download then uses the new one. Changing a PDF password is a single pass rather than an unlock-then-protect round trip.

A worked example

Take a 3-page document of 1,325 bytes. Protected, it comes out at 2,159 bytes. Encryption made it larger, which surprises people, but the growth is not proportional to the file: AES adds an initialisation vector and padding to every string and stream, so the overhead tracks the number of objects in the document - roughly 50 bytes each here, and invisible on a 4 MB scan.

Ask the locked file how many pages it has and it refuses to answer - not because of a flag, but because the structure it would have to read is encrypted. Supply the password and it reports 3 pages, with the text of every page identical to the original. Nothing is re-rendered, re-compressed or flattened into images: text stays selectable text, links stay links, and the document looks exactly as it did.

What AES-256 means here

The tool writes AES-256, which the PDF specification calls revision 6 - the strongest encryption the format defines, and the same class of algorithm behind full-disk encryption and HTTPS. Streams, strings and the file structure are all covered.

Older PDFs often use 40-bit encryption or RC4, and both are broken: files using them can be opened without the password by readily available software. Those modes are deliberately not offered, because a file protected with them looks protected while not being protected - worse than an unlocked file you know is unlocked.

Choosing a password that holds

Because the encryption is sound, the password is the whole of your security - an attacker guesses passwords rather than attacking AES. Length defeats guessing, and it matters far more than symbols do.

Four unrelated words beat a scrambled eight characters, and you can actually retype them: harbour-quilt-ledger-9 is stronger and easier than Xk!7pQ2z.
Do not reuse a password you use for accounts. This one gets typed into a colleague's laptop or read over the phone, and it travels with the file for as long as the file exists.
Do not use a date of birth or account number just because banks do. Those are short, structured and guessable - convenience, not strength.
Save it in a password manager before you download, not after. This is the step people skip.

If you lose the password

The document cannot be opened again - not by this tool, not by any other, and not by us. There is no copy of the key in the file and no back door in the format: the password derives the key, so without it your pages are unreadable rather than hidden behind something that can be switched off. Any service claiming otherwise is either guessing common passwords or misleading you.

That is encryption working as intended rather than a limitation, but it does make a protected PDF a genuine commitment. Keep the unprotected original somewhere safe.

Sending a protected PDF to someone

Send the password through a different channel than the file. Putting it in the same email as the attachment defeats the protection entirely, and it is easily the most common mistake here - text it, or say it on a call. Your recipient needs no special software: a document open password is part of the PDF standard, so Acrobat, Preview, Chrome and every phone viewer simply prompt for it.

Do the other work first. A password goes on a finished document, so merge it, compress it for email, or remove the pages you are not sending before you protect it - afterwards, every one of those steps needs the password again.

Is it private?

Yes, and here it is more than a nicety. Protect PDF runs entirely in your browser: the document and the password are both handled on your own device and neither is ever uploaded. A service that asks you to upload a confidential file along with the password meant to protect it has already handed a stranger's server both halves - and the files people want to protect are passports, medical letters, contracts and payslips, exactly the category that should not be leaving your machine.

Protect your PDF now

If you are about to send something you would rather not see forwarded, open Protect PDF, set a password you have written down, and download the encrypted copy. It is free, and neither your document nor your password leaves your browser.

Frequently asked questions

How do I password protect a PDF for free without Acrobat?: Use a browser-based tool like this one: open Protect PDF, drop the file in, type a password twice and download the protected copy. It needs no account, no installation and no Acrobat subscription, and because the encryption runs inside the browser tab the document is never uploaded. The result is a standard encrypted PDF, so the person you send it to can open it in Acrobat, Preview, Chrome or any phone viewer - they just get a password prompt first.
Can a password-protected PDF be cracked?: Not the encryption itself. This tool writes AES-256, and there is no known practical attack against it - which is why the password is the part that matters. A short or common password can be guessed by software that tries millions of candidates, and that is the realistic threat, so length is what protects you: four unrelated words are far harder to guess than eight scrambled characters. What you should not trust is an old PDF using 40-bit or RC4 encryption, since those are genuinely broken and can be opened without the password.
What is the difference between protecting a PDF and restricting printing or copying?: Protecting encrypts the document, so it cannot be opened at all without the password. Restricting only sets flags asking readers not to print, copy or edit - the file still opens for anyone, and the flags are honoured voluntarily, so any tool can strip them in seconds. If your goal is that the wrong person cannot read the file, you need the open password. Restrictions are useful only as a polite signal to colleagues, never as security.