The short answer: open your PDF in an encryption tool, set an open password (and optionally a permissions password), choose strong AES encryption, and save. Anyone without the password gets nothing — the file won't even show a preview.
The two kinds of PDF passwords
PDFs support two different passwords, and they do very different jobs. Knowing which one you need saves confusion later.
The user password — sometimes called the open or document password — locks the whole file. No password, no access: the reader can't even display the first page. This is the one you want for confidential files, financial statements, and anything that shouldn't be opened by the wrong person, period.
The owner password — the permissions password — lets anyone open the document but restricts what they can do with it: printing, copying text, editing. It's handy for distributing a readable-but-locked file, like a price list clients can view but shouldn't copy-paste into a competitor's spreadsheet.
You can use either or both at once. For most sensitive documents, the user password is the one that actually matters.
How to password-protect a PDF, step by step
1. Decide who needs access. A password only works if the right people have it and the wrong people don't. Sort that out before you encrypt — changing your mind afterward means re-encrypting and redistributing.
2. Open an encryption tool. PDFEdit's protect tool runs entirely in your browser — free, no account, and your file never uploads anywhere. For a document sensitive enough to lock, "never leaves your device" is exactly the property you want.
3. Set a user password. This is the password people need to open the file. Make it strong (more below) — a password like "invoice2024" won't survive five minutes against anyone actually trying.
4. Optionally set an owner password. If you want people to read but not print or copy, set the permissions here. Skip it if everyone with access should have full use of the file — unused restrictions just create support headaches.
5. Choose modern encryption. If the tool offers a choice, pick AES-128 or AES-256. Avoid the older RC4 option, which is weak by today's standards and only exists for compatibility with ancient software.
6. Save and test. Download the protected file, close it completely, and reopen it to confirm the password prompt appears and your password works. Then hunt down and delete any unprotected copies sitting in your downloads folder or email drafts.
Picking a password that actually holds
Short, predictable passwords are the number one reason PDF protection fails — not fancy attacks, just guessing. A few rules that actually help: make it long (sixteen or more characters beats clever), make it random (let a password manager generate it), and never reuse a password you use for email or banking. Then store it in that password manager. "I forgot the PDF password" is the most common headache in document security, and unlike a website login, there's no reset link.
How strong is PDF encryption, really?
Strong enough for real-world use — with one big caveat: the password. AES-256, the modern standard, isn't going to fall to brute force in your lifetime or anyone else's. What breaks PDF encryption in practice is never the math; it's weak passwords. Short, predictable, reused. An attacker doesn't crack AES — they guess "Company2024!" in eleven tries and walk right in.
So the encryption itself is solid. The password is the entire game. Pick a long, random one, store it in a password manager, and the math is firmly on your side.
Sharing a protected PDF without undermining it
The encryption is only half the job; distribution is the other half. Send the file through one channel and the password through another — email the PDF, text the password, or share it on a call. Don't invent the password inside the email thread where you're attaching the file. And set expectations with recipients: ask them not to forward the password casually, because every extra copy is another chance for it to leak. None of this is complicated, but skipping it is how "protected" files end up effectively unprotected.
Mistakes that leave files exposed
Emailing the password with the file. Sending contract.pdf plus "password is autumn2024!" in the same message defeats the entire purpose. Different channel, every time.
Using the old, weak encryption. Some tools default to 40-bit RC4 for compatibility. Unless you have a specific reason — and you almost certainly don't — choose AES.
Forgetting the unprotected original. You encrypt the file, download it, and leave the original sitting in downloads or attached to a draft email. The protected copy is now theater. Clean up.
Assuming a password hides metadata. Encryption locks the content, but filenames and surrounding context can still leak information. If specific words must never be seen by certain eyes, redact them before you encrypt.
Treating a permissions password as a vault. Owner-password restrictions are honored by well-behaved readers, but they're not as strong as a user password. Think of them as a polite request, not a lock.
What password protection can't do
A password stops casual access — the lost laptop, the forwarded email, the curious coworker. It doesn't stop someone you gave the password to from sharing the file further, and it doesn't remove sensitive content from the document itself. For information that should never reach certain eyes at all, redaction is the answer; for limiting who can open the file, encryption is. Used together, they cover the vast majority of real-world situations — and both take just a few minutes in PDFEdit.
