How to Password-Protect a PDF (and What It Really Protects)

Short answer

Set a password to open (the “user” password). That is the one that encrypts the contents; without it the file can’t be read. Use a long passphrase rather than a date of birth, and send the password by a different channel from the file, such as a text message or a call. Permission passwords that “block printing or copying” are weak and easy to remove. Do it in Protect PDF as the very last step, after any edits.

Bank statements, payslips, medical reports and contracts arrive password-protected all the time, so it is natural to assume that a password makes a PDF “secure.” Sometimes it does. Sometimes it is closer to a sticky note that says “please don’t read this.”

The difference comes down to which of the two PDF passwords you set, how strong it is, and how the password travels to the other person. None of it is complicated once you see how the pieces fit.

PDFs have two different passwords

This is the part that confuses almost everyone, because both are just called “password” in most apps.

	Open password (user password)	Permissions password (owner password)
What it does	Needed to open and read the file at all	Asks PDF apps to block printing, copying or editing
Is the content encrypted?	Yes, unreadable without the password	The file opens for anyone, so in practice no
How strong is it?	As strong as the password you choose	Weak: many apps ignore it, and free tools remove it in seconds
Use it for	Confidential documents	Signalling intent, not real protection

If you remember one thing from this article, make it this: only the open password protects the contents. A PDF that opens without a password but “can’t be printed” can be read by anyone who has the file, and the restriction itself can be lifted by tools such as Unlock PDF without knowing any password.

What the encryption actually does

When you set an open password, the text, images and other content inside the PDF are scrambled with an encryption algorithm. The password is turned into the key that unscrambles them. Without the right password, a PDF reader sees only noise.

The algorithm matters less than you might think, as long as it is a modern one:

RC4, used by very old PDFs, is considered broken. Files protected this way, especially with 40-bit keys, can be opened without the password. PDF 2.0 removed RC4 from the specification.
AES-128 and AES-256 are both strong. CleanPDF’s Protect PDF uses AES-128, which every current PDF reader supports, including Adobe Reader, browser viewers, macOS Preview and phone apps.

With AES, nobody attacks the algorithm. They attack the password. That is why the next section matters more than any setting.

Choosing a password that actually holds

Encrypted PDFs can be attacked offline: someone with the file can try millions of passwords on their own computer without anyone noticing or rate-limiting them. Short or guessable passwords fall quickly.

Length beats cleverness. A four- or five-word passphrase such as copper-lantern-river-quiet is far harder to guess than P@ssw0rd1.
Avoid personal facts. Dates of birth, phone numbers, ID card digits and account numbers are exactly what an attacker tries first. Many banks protect statements with your date of birth for convenience. That keeps out a casual snoop, not a determined one.
Use a new password per document or per recipient, so one leak doesn’t open everything.
Store it somewhere safe. A password manager is ideal. There is no “forgot password” link for a PDF.

If you forget the open password, the file is gone. Good encryption has no back door. Tools that remove passwords, including ours, need the open password; only the weak permissions password can be removed without it. Keep an unprotected original somewhere safe.

How to password-protect a PDF

Finish the document first.
Encryption should be the last step. Compress, merge, add a watermark or signature before you protect the file, because most tools need an unlocked PDF to make changes.
Open it in Protect PDF.
The file is encrypted in your browser and never uploaded, which matters for exactly the kind of documents people protect.
Set the password to open.
Type your passphrase, then confirm it. Use the eye icon to check you typed it correctly; a typo here locks you out.
Download and test it.
Open the protected file once. It should ask for the password, and the right password should open it.

The most common mistake isn’t a weak password. It’s putting the password in the same email as the attachment. Anyone who gets hold of that email, whether through a forwarded thread, a shared inbox or a compromised account, gets both the lock and the key.

Send the password a different way:

a text or WhatsApp message to the recipient’s phone,
a phone call, or
a password you agreed in advance for a regular exchange, such as monthly payslips.

It feels slightly clumsy. It is also what makes the protection real.

What a PDF password can’t do

Once the recipient opens the file, the password has done its job. From that point they can:

take screenshots or photos of the screen,
print it, or “print to PDF” to make an unprotected copy, depending on the app,
copy text out of it, and
forward the file and the password to someone else.

Encryption protects a file in transit and at rest: on a lost laptop, in an intercepted email or in a shared folder. It doesn’t control what an authorised reader does afterwards. If that is your worry, add a visible watermark with the recipient’s name, for example “Prepared for Sara Khan – 8 Nov 2026”. It won’t stop a leak, but it makes clear where a leaked copy came from.

Also remember that the file name is never encrypted. “Ahmed-salary-revision-2026.pdf” tells anyone who sees the attachment what is inside, even if they can’t open it.

When it’s worth protecting a PDF

Payslips, salary letters and tax documents sent by email
Medical reports and test results
Contracts and offers before they are signed
ID scans and passport copies you have to email
Files stored on shared drives or USB sticks that could be lost

For documents that should be public, such as menus, brochures and price lists, a password just gets in the way.

Removing a password you know

Typing the password every time gets old for documents you keep for yourself, such as your own bank statements. If you know the open password, Unlock PDF saves an unlocked copy. Store that copy somewhere that is itself protected, such as an encrypted drive or your password manager’s file storage.

Protected PDFs and email filters

One practical snag: some company email systems block or quarantine encrypted attachments, because their virus scanners can’t look inside them. If your protected PDF never arrives, that is the most likely reason. Ask the recipient whether they can receive encrypted files, or share the file through a link from your cloud storage with the password sent separately.

Common mistakes

Only setting a permissions password and assuming the file is protected.
Emailing the password with the file.
Using a date of birth or ID number as the password.
Protecting before editing, then having to unlock, edit and protect again.
Deleting the original and then forgetting the password.
Telling the recipient the password inside the PDF’s file name. It happens more often than you would think.

Frequently asked questions

What is the difference between a PDF open password and a permissions password?

The open (user) password encrypts the file, so it can’t be read without it. The permissions (owner) password only asks PDF apps to block printing, copying or editing; the file still opens for anyone, and the restriction is easy to remove.

How secure is a password-protected PDF?

With AES encryption and a long, unique password, the contents are very hard to open without the password. Short or guessable passwords such as dates of birth can be cracked offline, so the password is the weak point, not the encryption.

Can a password-protected PDF be opened without the password?

Not if it uses AES with a strong open password. Old files using RC4 encryption, files with guessable passwords and files that only have a permissions password are much easier to open.

I forgot the password to my PDF. Can it be removed?

If it is the password needed to open the file, no legitimate tool can remove it without the password; that is the point of encryption. If the file opens but printing or copying is blocked, that restriction can be removed with an unlock tool.

Should I protect a PDF before or after compressing it?

After. Compress, edit, sign and watermark first, and add the password last. Most tools can’t change an encrypted PDF.

Does a PDF password stop people printing or copying?

Only until the file is open. A reader who knows the open password can take screenshots or copy the content, and permission restrictions are ignored by many apps.

Add a password to your PDF

AES encryption applied in your browser. The file and the password never leave your device.

Open Protect PDF

Akhtar Ali

Runs CleanPDF and builds its browser-based PDF, image and QR tools. Writes the site’s guides on everyday document problems.