Two types of PDF passwords
PDF security uses two distinct password types that most people don't realize are different:
User password (Open password)
Required to open and view the document. Anyone without this password sees an "Enter password" prompt when they try to open the file. This is what most people mean when they say "password protect a PDF."
Owner password (Permissions password)
Controls what users can do AFTER they open the PDF. With the owner password set, you can restrict:
- Printing the document
- Copying text and images
- Editing content
- Adding annotations or form fields
- Extracting pages
A PDF can have an owner password without a user password — meaning anyone can open it but specific actions are restricted. Or it can have both.
PDF encryption standards
AES-128 bit (PDF 1.5, Acrobat 7+)
Older encryption standard. Broadly compatible — every PDF reader can open AES-128 protected files. Considered adequate for most uses.
AES-256 bit (PDF 1.7 extension, Acrobat 9+)
Stronger encryption. Computationally infeasible to brute-force with a strong password. Compatible with all modern PDF readers (Acrobat Reader, Preview, Chrome, Edge). Recommended for any sensitive documents.
Practical choice: Use AES-256 for any document with sensitive information. Use AES-128 only if you need compatibility with very old software.
Password strength matters enormously
PDF encryption is only as strong as your password. Automated tools can attempt millions of passwords per second against a PDF file. A weak password provides false security.
| Password type | Example | Approximate brute-force time |
|---|---|---|
| 4-digit PIN | 1234 | Seconds |
| Common word | "summer" | Minutes |
| Mixed 8 chars | "P@ssw0rd" | Hours to days |
| Random 12+ chars | "xK9!mL2@pQr7" | Centuries |
| Passphrase | "correct-horse-battery-staple" | Billions of years |
A passphrase (random words strung together) is both strong and memorable.
When to password protect PDFs
High priority situations:
- Contracts and legal documents before signing
- Financial statements, tax returns, salary information
- Medical records and insurance documents
- HR documents (offer letters, performance reviews)
- Documents shared with external parties before public release
- Research or business documents under NDA
Lower priority:
- Public-facing documents (no need to protect)
- Internal documents that will be extensively shared (password becomes a friction point)
PDF security limitations
Password protection is not foolproof:
- Strong passwords with AES-256 are effectively unbreakable
- Weak passwords can be brute-forced
- Permissions passwords (restricting printing/copying) have historically been weak — some tools bypass them without the password
- If you give someone the user password to view the document, a determined person can eventually extract the content
For highly sensitive documents, consider additional protections: digital rights management (DRM), document tracking, or keeping sensitive content offline entirely.
Browser-based encryption vs server-based
Most online PDF password tools upload your file to their servers, encrypt it there, then send it back. This means an unencrypted copy of your document passes through their infrastructure — the opposite of the security you're trying to achieve.
Privatool's PDF password protector encrypts your document entirely in the browser using your device's CPU. The unencrypted PDF never leaves your device.
How to password protect a PDF free
- Go to PDF Password Protector
- Upload your PDF file
- Enter your desired password (use the strength indicator)
- Set permissions if needed (allow/restrict printing, editing, copying)
- Download the protected PDF
Your original file is never uploaded anywhere.