How to Password Protect a PDF

A PDF with a password on it is the difference between "I emailed the contract" and "I emailed the contract to the wrong Sarah and now she has my client's bank details." Encryption takes about thirty seconds and costs nothing.

The catch with most free tools: they want your file uploaded to their server, your email address, or both — which means the document you're trying to keep private takes a detour through someone else's infrastructure first. FileNaut's Protect PDF tool runs entirely in your browser using AES-256 encryption. Your file never uploads. Your password is never transmitted. Close the tab and nothing remains.

This guide covers the browser method, the built-in options on Mac and Windows, what PDF permissions actually do (and don't do), and how to pick a password that's worth the encryption behind it.

This works on any device with a modern browser — Windows, Mac, Chromebook, iPad, Android. Nothing to install.

1. Open the Protect PDF tool. No account, no email, no signup wall.
2. Drop your PDF in — drag it onto the upload area or click to browse. The file loads into your browser's memory, not onto a server.
3. Type your password twice. Minimum four characters (though see the password section below — four is the technical floor, not a recommendation). A green check appears when both fields match, and the eye icon reveals what you typed so a typo doesn't lock you out of your own document.
4. Set the permissions. Three checkboxes control what someone can do after they've opened the file: allow printing (on by default), allow copying text (off by default), allow modifying (off by default). Read the honesty section below before relying on these.
5. Click Protect PDF. Encryption runs locally — a second or two for most documents, longer for large scanned files. Your browser is doing the work, so speed depends on your device, not your internet connection.
6. Download the result. It saves as yourfile-protected.pdf, leaving your original untouched. Open it to confirm the password prompt appears before you send it anywhere.

Test it before you send it. Open the downloaded file, enter the password, confirm it works. Thirty seconds of checking beats an email thread that starts with "it won't open."

Most "free PDF password" tools don't say what algorithm they use, which is usually a sign you don't want to know. FileNaut uses AES-256 — the same standard Adobe Acrobat applies, and the strongest encryption the PDF specification supports.

The practical meaning: a correctly implemented AES-256 PDF cannot be brute-forced with current technology. Every real-world "PDF password cracker" attacks the password, not the encryption — it guesses common passwords quickly. Which is why your password choice is the entire security story here, and the algorithm is not.

This is the part most guides skip, and it matters.

The PDF format supports two separate passwords: a user password (required to open the document) and an owner password (controls printing, copying and editing). The permission flags — no printing, no copying, no editing — are instructions to the PDF reader, not cryptographic locks. Adobe Acrobat, Preview and Chrome respect them. Plenty of other software simply ignores them, and anyone who knows the owner password can strip them in seconds.

Be aware: FileNaut sets the user and owner password to the same value. So the permission checkboxes are useful as a polite signal — "please don't copy text out of this" — and useful against accidental edits. They are not a barrier against someone who is determined and already has the password to open the file.

The rule of thumb: the open password is the real security. Permissions are etiquette. If a document genuinely must not be printed or extracted by the recipient, a password won't achieve that — no PDF setting will. Anyone who can see a page can photograph it.

AES-256 with the password 1234 is a vault with the key taped to the door. Cracking tools try the top million common passwords first, and they get through most documents in under a second.

• Length beats complexity. Four random words — anchor-plum-drift-kettle — is far stronger than P@ssw0rd! and dramatically easier to relay over the phone.
• Never reuse a password you use elsewhere. You're about to email this to someone. Assume it will be forwarded, screenshotted, or left in an inbox for years.
• Don't make it guessable from the document. The invoice number, the client's company name, and the date are the first three things anyone tries.
• Generate it if you're stuck. The Password Generator builds one in your browser in a click — nothing is transmitted or logged.

More on what actually makes a password hard to crack in the strong password guide.

The most important rule: send the password through a different channel than the file. A password in the same email as the PDF protects nothing — anyone who intercepts one has both. Email the document, text the password.

Mac (Preview — built in, free)

1. Open the PDF in Preview.
2. Choose File → Export as PDF (not "Export as…", not Save).
3. Click Permissions…, tick "Require password to open document," enter it twice, then Apply and Save.

Preview handles the common case well, but gives you little control and no visibility into the encryption level applied.

Windows

Windows has no built-in PDF encryption. The Microsoft Print to PDF driver cannot add passwords. Your options:

• Microsoft Word: if the document started as a .docx, use File → Save As → PDF → Options → "Encrypt the document with a password." Not available for PDFs you didn't create.
• Adobe Acrobat Pro: full control, roughly US$20+/month.
• The browser tool: free, works on any PDF, nothing installed.

iPhone, iPad and Android

iOS Files can lock a PDF (long-press the file → Lock PDF, using Face ID or a password), but that's device-level and doesn't reliably travel with the file everywhere. Android has no native option at all. The browser tool works on both — open it in Safari or Chrome, pick the PDF from Files or Drive, and it encrypts on the phone itself.

• "Failed to protect PDF." Nearly always means the file is already encrypted, or is damaged. Remove the existing password first with the Unlock PDF tool, then re-protect it with the new one.
• The recipient can't open it. Check for a trailing space in the password when it was copied and pasted — the single most common cause. Very old PDF readers may also not support AES-256; updating the reader fixes it.
• You forgot the password. There's no recovery. AES-256 with a decent password is not recoverable by you, by FileNaut, or by anyone else. Keep the unprotected original somewhere safe, or store the password in a password manager before you send the file.
• The file is too big to email even after protecting it. Encryption doesn't change file size meaningfully. Run it through Compress PDF first, then protect the smaller version — compression tools can't read an encrypted file.
• You need to merge or edit it later. Do all editing, merging and signing before you encrypt. Password protection should always be the last step in your workflow.