How to Password-Protect a PDF File

Most people think of a PDF password as a single thing, but the PDF specification actually defines two distinct types of password protection, which serve different purposes.

An open password (also called a user password) restricts who can open and view the file at all. Anyone who tries to open the PDF will see a password prompt. Without the correct password, they cannot read the document. This is the type of protection most people imagine when they hear "password-protected PDF."

A permissions password (also called an owner password) allows the file to open normally without a password, but it restricts what the reader can do. You can use it to prevent printing, copying text, filling forms, or adding annotations. The file is visible to everyone but certain actions are locked.

iKeepPDF's Protect PDF tool applies an open password with strong AES-256 encryption, which is the most useful protection for most people sharing sensitive documents.

When a tool says it uses "AES-256 encryption," it means the document contents are scrambled using the Advanced Encryption Standard with a 256-bit key. This is the same standard used by governments and financial institutions worldwide. Without the password, brute-forcing an AES-256-encrypted PDF is computationally infeasible with current technology — it would take longer than the age of the universe to try every possible key.

The practical implication: if you use a strong password, nobody is going to crack your encrypted PDF by attacking the encryption directly. The encryption itself is solid. The weak link is always the password — if you use "1234" or your name, the protection is trivially bypassed with a dictionary attack.

A strong PDF password should be at least 12 characters, mix uppercase, lowercase, numbers, and symbols, and not be a dictionary word or obvious pattern. A password manager can generate and store these for you.

1. Open the Protect PDF tool on iKeepPDF.
2. Upload your PDF by dragging it into the upload area or clicking to browse.
3. Enter a strong password in the password field. Use the show/hide toggle to verify you have typed it correctly.
4. Click Protect. The browser encrypts the file locally using AES-256.
5. Download the protected PDF. Test it immediately by opening it in a new tab to confirm the password prompt appears.

Because iKeepPDF processes everything in your browser, your file and your password are never sent to any server. This is particularly important when protecting sensitive documents — you are not handing your confidential file to a third-party service just to add a password.

Once someone has legitimately opened a password-protected PDF with the correct password, they can take a screenshot of every page. No technical measure prevents this. If you share a document and the recipient has the password, they can capture every page visually regardless of any permissions settings.

PDF permissions passwords (which restrict printing and copying) are also relatively easy to bypass with dedicated software. Unlike open passwords which use strong encryption, permissions restrictions in many PDF implementations are enforced at the application level rather than through cryptographic means. Do not rely on permissions passwords as a strong security measure.

Finally, a password-protected PDF stored on a compromised device is not safe. If an attacker has access to the device where you store the password, they have access to both the file and the key. For very sensitive long-term storage, consider full-disk encryption rather than relying solely on PDF passwords.

If you protected a PDF and now want to share it freely or stop requiring the password to open it, the Unlock PDF tool removes the password. You will need to enter the current password to prove you are authorised to remove it, after which the file opens without any restrictions.

This is useful when a document was distributed under controlled circumstances and the protection period has passed — an annual report released under embargo, or an exam paper that is now public. Rather than keeping track of passwords indefinitely, you can simply remove the restriction once it is no longer needed.