Think about the PDFs you have emailed in the last year. A payslip to a mortgage adviser. A signed contract to a client. A scan of your passport for a hotel or a new job. A medical report to an insurer. Each one left your hands and landed in an inbox you do not control, where it may be forwarded, synced to a phone, backed up to the cloud, or left open on a shared computer.
A password on a PDF will not stop every risk, but it changes what happens when a file ends up in the wrong place. Instead of a readable document, the stranger gets an encrypted file they cannot open. This guide explains how PDF passwords actually work, how strong the protection is, and how to choose and share a password so it genuinely protects you.
What a PDF password really does
There are two kinds of PDF protection, and they are very different.
Permission restrictions (sometimes called an owner password) ask PDF readers not to allow printing, copying or editing. The document can still be opened by anyone, and many tools ignore these restrictions. They are a polite request, not security.
An open password (a user password) encrypts the content of the file. Without the password, the pages are scrambled data. No reader, converter or clever trick can show the content, because it is not stored in readable form.
Protect PDF sets an open password. The same password is used to open the file and to change its security settings, which keeps things simple: one password, and nobody reads the file without it.
How strong is the encryption?
The file is encrypted with AES-256, the strongest encryption the PDF format supports and the same standard used to protect banking and government data. With a strong password, there is no practical way to break the encryption itself.
That last condition is the important one. AES-256 is only as strong as the password you choose. Attackers who get hold of an encrypted PDF do not attack the encryption; they try passwords, millions per second, starting with common words, names, dates and simple patterns. A password like "Priya1990" might last seconds. A long random password or passphrase would take longer than anyone could spend.
How to password-protect a PDF
- Open Protect PDF and choose the file (up to 100 MB).
- Type a strong password, ideally generated rather than invented (more on that below).
- Save the password somewhere safe before you download, such as a password manager.
- Download the protected PDF and test it: open it and confirm it asks for the password.
- Send the file and the password separately.
The file travels over HTTPS and is encrypted on our server with PyMuPDF. The file and the password are deleted from the server as soon as the protected PDF is returned; nothing is stored.
Choosing a password that actually protects
The best password for a PDF is one you do not have to remember, because it lives in a password manager. Good options:
| Type | Example style | Strength |
|---|---|---|
| Random characters, 16+ | xT7#qL2!vR9@mK4p | Excellent |
| Passphrase of 4–5 random words | copper-lantern-voyage-mint | Excellent, easier to read out |
| Name plus year | Sharma2024 | Weak, guessed quickly |
| Dictionary word with a number | Contract1 | Very weak |
The Password Generator creates random passwords and passphrases in your browser; nothing is sent anywhere. Passphrases are especially useful for PDFs, because you often have to tell the recipient the password by phone, and "copper lantern voyage mint" is much easier to say than a string of symbols. Our password security guide covers password managers and how to store passwords safely.
Avoid anything connected to the document or the person: their date of birth, the client name, the invoice number. Those are the first things someone with the file would try.
Share the password the right way
The most common mistake with protected PDFs is sending the password in the same email as the file. If the email is forwarded, intercepted or read on an unlocked phone, both pieces arrive together and the protection is worthless.
Use a different channel:
- Email the file, text the password. The simplest and most common approach.
- Say it on a phone call. Ideal for passphrases.
- Agree a password in advance with people you send documents to regularly, such as your accountant, and store it in both your password managers.
- Use a secure messaging app for the password if you already use one with the recipient.
When to protect a PDF
A good rule: if you would be upset to see the document on a stranger's screen, protect it. Common examples:
- Payslips, tax returns and bank statements sent to mortgage brokers, landlords and accountants
- Identity documents, such as passport and ID card scans
- Contracts and offers with prices, salaries or personal details
- Medical reports and insurance claims
- HR documents, such as disciplinary letters or references
- Business documents, such as financial forecasts, pitch decks and client lists
For identity documents in particular, consider adding a watermark stating the purpose, such as "For tenancy application only", with Watermark PDF before protecting the file. If the copy leaks, it is much harder to misuse.
What a password does not do
Being clear about the limits helps you decide what else a document needs:
- Once opened, the content is readable. Anyone with the password can read, print, screenshot or save an unprotected copy. Share the password only with people you trust with the content.
- It does not hide information from the recipient. If there are details the recipient should not see, remove them first with Redact PDF. Our guide to redacting a PDF properly explains why covering text with a black box is not enough.
- It cannot be recovered. If you forget the password, the file is lost. There is no backdoor; that is what makes the protection real.
- The file name is not encrypted. Do not put sensitive details in the file name.
Removing a password later
Sometimes you need to take protection off, for example to merge a protected statement with other documents, convert it to Excel, or upload it to a portal that rejects encrypted files. If you know the password, Unlock PDF saves an unprotected copy. Our guide to removing a password from a PDF walks through it, including the password formats banks commonly use.
A practical workflow for sending a bundle of documents is: unlock any protected files, combine everything with Merge PDF, compress it if needed, and protect the final file with a single new password.
Frequently asked questions
How secure is the protection?
The PDF is encrypted with AES-256. With a strong password, the content cannot be read without it.
Will the recipient need special software?
No. Every standard PDF reader, including web browsers and phone apps, asks for the password when the file is opened.
Is my password stored?
No. It is used only to encrypt the file, and both are deleted from the server once the protected PDF is returned.
Can I set separate passwords for opening and editing?
Not with this tool. The same password opens the file and controls its security settings.
What if I forget the password?
The file cannot be opened. Keep passwords in a password manager.
A PDF password takes a minute to add and protects a document for as long as it exists. Generate a strong one, protect the file with Protect PDF, send the password another way, and a misdirected email becomes a non-event instead of a data leak.
