How to password protect a PDF, and which of the two passwords protects nothing

Open the file in PADLOCK, type a password to open it, and save. The file is encrypted with AES-256 under the handler in the PDF specification, so Acrobat, Preview, Chrome, Firefox and everything else will ask for that password and will not show a word without it. To take a password off, you need the password: type it and save the unlocked copy. Both happen in the tab; the file is not uploaded, and the page works with the network off, which matters more here than anywhere else on this site, because the alternative is handing a stranger both the confidential file and its password.

A PDF can carry two passwords

The owner password protects nothing

This is the part worth knowing before you rely on it. A PDF with only an owner password is not encrypted against being read. It opens in any reader, immediately, with no prompt. The "no printing, no copying" flags are a request, written into the file, that the reader is asked to honour. Acrobat honours them. Plenty of other readers do not, and any program that can read the file at all can ignore them, because the content is right there.

That is why the websites offering to "unlock" or "remove restrictions from" a PDF work instantly and without asking for a password. They are not breaking anything. They are re-saving a file that was never closed. PADLOCK does the same thing and says so in plain words rather than implying a feat: it reports that the file opens without a password, that the lock is the permissions alone, and it takes them off.

An owner password is still worth setting on top of a user password — it stops the casual "print, copy, done" — but on its own it is a label, not a lock.

What the real one does

Set a password to open it and the file is encrypted. PADLOCK writes AES-256 under revision 6, the handler in PDF 2.0: the strings and the streams are encrypted, the keys are derived from your password, and the file carries the standard entries a reader needs to check it. Nothing that reads PDFs has a back door into that, and neither does this page — which is exactly why, if you lose the password, the file is gone. It will say so rather than offer to help.

The strength is the password, not the cipher. AES-256 behind Summer2024 is a guess away. PHRASE makes a passphrase worth the encryption; KEYS keeps it somewhere you will still have it next year.

Sending the password

A locked PDF and its password in the same email is an envelope with the key taped to it. Send the password another way — a text message, a phone call, anything that is not the channel carrying the file. If you are sending to somebody who will need it more than once, KEYRING encrypts to their public key instead, and there is no shared secret to send at all.

What "remove the password" can mean

• You have the password. Then it is straightforward: the file is decrypted and written back without the encryption, and the copy opens anywhere. This is the normal case — a statement your bank locks with your date of birth, a payslip locked with your employee number.
• It only had an owner password. Then there was nothing to remove but the flags, and any tool can do it in a second.
• You do not have the password. Then nothing legitimate will open it. A site that offers to is either doing the owner-password case above and letting you believe otherwise, or it is guessing passwords — on your confidential file, on their server.

The files this will not take

Some PDFs are locked to a certificate rather than a password: only the matching private key opens them, which is how a company issues documents to named people. PADLOCK reads what the file says and tells you that is what you have, rather than failing obscurely. The same goes for a security handler it does not know: it says which one, and leaves the file alone.

Locking is not redacting

A password stops somebody without it from reading the file. It does nothing about what is in the file once they are in. If a paragraph should not be there, take it out with SEAL, which removes the text rather than drawing a black box over it. If the question is what else the file is carrying — the author, the software, earlier versions of the document — X-RAY shows it and STRATA digs out the earlier drafts a PDF saves inside itself.

The short version