PDF Password Protect

How PDF password protection works

PDF password protection applies encryption to your document so that it can only be opened or modified by authorised users. Two distinct passwords can be set: a user password that controls who can open the file, and an owner password that controls what they can do with it once it is open. When both are set, anyone entering the user password gains read access while only the owner password holder can modify permissions or remove protection entirely.

The encryption standard used by most PDF tools is based on the RC4 or AES algorithms defined in the PDF specification. Modern PDF readers support AES-128 and AES-256 encryption, which provide strong protection for document contents. Older PDF viewers may only support the weaker RC4-based encryption, so compatibility depends on which viewer your recipients use and which PDF version your document targets.

When to password-protect PDFs

Password-protecting PDFs is essential whenever sensitive information must be shared electronically. Legal professionals regularly encrypt contracts, non-disclosure agreements and settlement documents before emailing them to opposing counsel or clients. A poorly secured PDF containing a draft merger agreement could expose confidential financial terms if intercepted or forwarded to the wrong recipient. Encrypting the document ensures that even if the email is compromised, the attachment remains unreadable without the correct password.

Financial services firms routinely encrypt quarterly statements, portfolio summaries and transaction confirmations. A wealth management advisor sending a client their quarterly performance report can password-protect the PDF so that only the client — who has been given the password over a separate communication channel — can view the detailed holdings and returns figures. This layered security approach, sometimes called out-of-band verification, significantly reduces the risk of a data breach through compromised email accounts.

Human resources departments use PDF encryption for employee records, salary reviews and disciplinary documentation. An HR manager distributing annual bonus letters to staff can encrypt each letter with a unique user password shared only with the individual employee. Even if the email is accidentally sent to the wrong person, the recipient cannot open the attachment without the specific password. Audit reports and compliance documentation often carry both passwords — a user password for general viewing and an owner password for the compliance officer who needs the ability to modify or remove restrictions.

Healthcare organisations handling patient records must comply with privacy regulations that mandate encryption for electronic transmission of protected health information. A clinic sending a patient's medical summary to a specialist can password-protect the PDF and provide the password via phone or secure messaging rather than email. The same approach works for insurance claims, referral letters and discharge summaries where unauthorised access would violate patient confidentiality and regulatory requirements.

How to use the PDF password tool

Limitations of browser-based encryption

PDF encryption is a complex process governed by the PDF specification maintained by ISO (ISO 32000). Implementing full encryption and decryption in JavaScript requires the cryptographic primitives defined in the PDF standard, including the algorithms for generating encryption keys from passwords, the RC4 and AES cipher implementations, and the specific key derivation functions that map passwords to encryption keys. While the pdf-lib library handles PDF parsing, modification and serialisation excellently, it does not include the encryption and decryption algorithms required to apply or remove password protection from PDF documents.

The PDF 2.0 specification (ISO 32000-2:2020) introduced a new encryption mechanism that addresses several security weaknesses in earlier versions. However, browser-based JavaScript libraries have been slow to adopt these standards because they require low-level cryptographic operations that are not exposed through the standard Web Cryptography API in a way that aligns with the PDF specification. This means that full client-side PDF encryption remains technically challenging to implement without relying on WebAssembly builds of low-level C libraries such as OpenSSL or mbed TLS.

For this reason, this tool focuses on password removal rather than encryption. If you have a PDF that is already encrypted and you know the password, you can upload it here and we will create a decrypted copy by loading the document through pdf-lib's ignore-encryption mode and copying every page into a fresh, unencrypted document. This approach works for many standard PDF files and is completely private — no data ever leaves your browser.

If you need to apply encryption to a PDF from scratch, we recommend using dedicated desktop software such as Adobe Acrobat Pro, PDF Expert or open-source tools like qpdf or pdftk. These tools implement the full PDF encryption specification including AES-256 encryption, owner and user password support, and permission flag management. They work reliably across all PDF versions and produce files that are compatible with every major PDF reader on the market.

Password removal with pdf-lib

This tool uses the pdf-lib JavaScript library to process PDFs entirely in your browser. When you upload an encrypted PDF, the tool reads it into memory and attempts to load it using pdf-lib's ignore-encryption mode. It then copies every page from the encrypted document into a brand-new PDF document that has no encryption dictionary. The result is a fully readable PDF without any password protection — all processed locally without any file upload to a server.

The removal process preserves all original content including text, images, fonts, annotations and form fields. The page dimensions, rotation and content stream compression remain exactly as they were in the original encrypted file. The only change is that the new document does not include the encryption dictionary, which means any PDF reader can open it without requiring a password. Interactive form fields and embedded JavaScript actions are preserved as long as they don't depend on the encryption layer for their functionality.

There is an important caveat: pdf-lib does not actually decrypt the content streams of the encrypted PDF. Instead, it re-serialises the raw PDF objects into a new document structure. For many encrypted PDFs this works perfectly because the content streams can be copied verbatim. However, some PDFs with more complex encryption schemes or those using features specific to newer PDF versions may produce garbled output. If the result is unreadable, the original PDF likely uses an encryption method that requires true decryption rather than structural re-serialisation.

Related tools

Frequently asked questions