PDF Passwords Explained: What They Do and Don't Protect

To password protect a PDF, add your file, type a password and download the encrypted copy; to remove a PDF password you must know the current one. The document is encrypted with AES-128 — or AES-256 where the file supports it — and both the PDF and the password are processed inside your browser, so neither is ever uploaded to a server. It takes about ten seconds, needs no account, and adds no watermark.

This guide answers the questions people actually ask about PDF passwords, including the ones with uncomfortable answers: what a password does not protect, why permissions restrictions are weaker than they look, and why a forgotten password means the file is gone.

What is a PDF password?

A PDF password is an encryption key that scrambles the document's contents so it cannot be read without that password. It is a property of the file itself, not of the app you opened it in — which is why a protected PDF stays protected when you email it, copy it to a USB stick or upload it to Drive.

PDFs can carry two different passwords, and confusing them causes most of the trouble in this topic:

• A user password (also called the open password) is required to view the document at all. Without it, the contents are unreadable ciphertext.
• An owner password (also called the permissions password) lets anyone open the file freely but is meant to restrict what they can do with it — printing, copying text, editing.

A file can have one, the other, or both. When people say "encrypted PDF" they almost always mean the user password.

How do I password-protect a PDF for free?

Use Protect PDF: add the file, set a password, download the result. Four steps, no sign-up:

1. Open Protect PDF.
2. Drag in the PDF you want to lock.
3. Type a strong password and confirm it.
4. Click Protect and download the encrypted file.

The download is encrypted wherever it travels. Anyone who opens it — in Acrobat, Preview, Chrome, Edge or any mainstream reader — is asked for the password before a single page renders.

What encryption does PDF password protection use?

Filevane encrypts with AES-128, and with AES-256 when the source document declares support for it. AES is the same cipher family used for HTTPS and online banking, and no practical attack against it is known.

This detail is worth checking on any tool you use, because PDF encryption is not one thing. The specification has supported several handlers over the years, and older ones are genuinely weak:

Handler	Cipher	Status
Revision 2	RC4 40-bit	Broken — recoverable on a laptop
Revision 3–4	RC4 128-bit	Deprecated, not recommended
Revision 4 (AESV2)	AES-128	Secure
Revision 6 (AESV3)	AES-256	Secure, PDF 2.0

Many libraries pick the handler from the source file's PDF version, which means encrypting an old document can silently produce RC4 while the interface still says "encrypted". Filevane raises any older document to a version that supports AES before encrypting, so the RC4 paths are never used.

What makes a strong PDF password?

Length matters more than complexity: a 16-character passphrase beats a short password full of symbols. Encryption is only as strong as the password guarding it, and AES-256 protected by P@ss1! is not protected at all.

• Aim for 12 characters minimum, 16 or more for anything sensitive.
• Prefer a passphrase — violet-harbor-42-clock is stronger than Xk9#p! and far easier to dictate over the phone.
• Make it unique to this file. A reused password means one breach elsewhere unlocks this document too.
• Avoid names, dates and anything else guessable about you or the document's subject.

Current NIST guidance (SP 800-63B) explicitly advises against forced composition rules — the "one uppercase, one digit, one symbol" pattern — because they shrink the search space and push people towards predictable substitutions.

Can a password-protected PDF be cracked?

An AES-encrypted PDF with a strong, unique password cannot be cracked with any known technique. The realistic attack is not against the cipher — it is against the password, by guessing.

That means the honest answer depends entirely on what you chose. A dictionary word or a short password can be brute-forced by readily available tools in minutes to hours. A 16-character random passphrase is not brute-forceable within any useful timeframe.

Two caveats worth knowing:

• Files encrypted with RC4 40-bit — usually very old documents — are breakable regardless of the password.
• Permission-only protection is not real protection. See below.

What happens if I forget my PDF password?

The file is unrecoverable. There is no backdoor, no reset and no support route — not from Filevane and not from Adobe. AES has no master key, which is precisely why it is trustworthy.

Save the password to a password manager before you send the document. This is the single most common way people lose access to their own files.

How do I send a password-protected PDF safely?

Send the password through a different channel from the file. Emailing an encrypted PDF and its password in the same message defeats the entire exercise: anyone who intercepts the message gets both.

• Send the file by email, the password by phone, SMS or a messaging app.
• Better still, agree the password in advance and never transmit it at all.
• Remember that encryption protects the contents, not the metadata. The filename, the recipient and the fact you sent it remain visible to your mail provider.

Can I let people read a PDF but stop them printing or copying it?

Yes — PDF Permissions sets an owner password and disables printing, copying, editing, annotating or form-filling while leaving the file readable without a prompt. Useful for price lists, reports and read-only handouts.

But be clear about what this is. Permission restrictions are enforced by the PDF reader, not by cryptography. The file has to open without a password, so the decryption key is derivable from the document itself — compliant readers such as Acrobat honour the restrictions, while plenty of other software ignores them entirely.

Treat permissions as a courtesy notice that deters casual copying, not as a security control. If the content genuinely must not be extracted, encrypt it with a user password or do not distribute it.

How do I remove a password from a PDF I own?

Use Unlock PDF: add the file, enter the password you already have, and download an unencrypted copy.

1. Open Unlock PDF.
2. Add the protected PDF.
3. Enter its current password.
4. Download the unlocked copy.

This removes a password you know from a document you are authorised to open. It does not crack unknown passwords, and no legitimate tool does — any site claiming otherwise is either lying or uploading your file.

Removing the password is often a necessary first step, because most PDF tools cannot read an encrypted file at all. Merging, compressing or running OCR on a protected document usually requires unlocking it first.

Does a password hide the information inside a PDF?

No — and this is the most consequential misunderstanding in this topic. A password controls access to the file. It does not remove anything from within it. Everyone who has the password sees every detail: the account number, the address, the signature, the salary line.

If specific information must be gone rather than guarded, you need redaction. Redact PDF removes the underlying content rather than covering it. Drawing a black rectangle in an editor leaves the text intact underneath, where it can be selected, copied or extracted — a failure that has caused a long series of public disclosure incidents.

Check your work: open the redacted file and try to select text in the blacked-out area. If anything highlights, the content is still there.

Is it safe to password-protect a PDF with an online tool?

It depends entirely on whether the tool uploads your file — and most do. In a transport-layer measurement of 20 online PDF tools published on 11 August 2026, 12 of the 13 services that could be measured transmitted the entire test file to their own servers. Filevane transmitted 0.00 MB.

The risk with a server-side tool is not usually malice; it is existence. Once your document and its password are on someone else's machine, they can be logged, cached, backed up, subpoenaed or breached, and "deleted after two hours" is a policy you cannot audit.

You do not have to take Filevane's word for it either. Open the browser's Network tab, run the tool, and watch for an outbound request carrying your file — there is not one. The privacy proof page publishes the Content-Security-Policy header that makes an upload impossible rather than merely against policy.

What does password protection not protect against?

A PDF password protects the file at rest. It does not protect a compromised device, hide the document's metadata, survive a screenshot, or remove any content from inside the file. Worth stating plainly, because most guides on this subject stop at the good news:

• It does not protect a compromised device. If malware is reading your screen, encryption at rest is irrelevant.
• It does not hide metadata. Author name, producer software and timestamps often survive — check with PDF Information.
• It does not survive a screenshot. Anyone who can read the document can photograph it.
• It does not protect the file once decrypted. The unlocked copy on someone's desktop is an ordinary PDF.
• It does not remove content. That is redaction's job.

Which tool do I need?

Goal	Tool
Stop people opening the file at all	Protect PDF
Let people read but not print or copy	PDF Permissions
Remove a password from your own file	Unlock PDF
Erase specific information permanently	Redact PDF
Sign a document before locking it	Sign PDF
Check what metadata the file exposes	PDF Information

Every one of these runs entirely on your own device. Nothing is uploaded, no account is required, and no watermark is added.