Add a password to a PDF, without sending it anywhere

There is something genuinely odd about uploading a confidential file to a website in order to make it confidential. The whole point of the exercise is that the document shouldn't be seen by third parties, and the first thing every online tool does is take a copy.

Here the encryption happens in your browser with AES-256, the strongest cipher the PDF specification supports. Neither the document nor the password is transmitted, because there's nowhere to transmit them to.

You can set the password needed to open the document, and separately restrict what someone can do once it's open — printing, copying text, or making further changes. It's worth knowing that those permission restrictions are advisory in the PDF format: compliant readers honour them, but they aren't enforced by encryption and plenty of software ignores them entirely.

What this does — and what it doesn't

  • PDF password protection is a weak control. It keeps casual readers out; it will not stop anyone determined, and password-removal tools are widely available. For genuinely sensitive material, encrypt the file itself or use a secure transfer method.
  • If you forget the password, the document cannot be recovered. We have no copy of either.

Next steps

Protect PDF — frequently asked questions

How strong is the encryption?
AES-256, the strongest the PDF specification supports. The practical weakness is the format rather than the cipher — PDF permission settings in particular are advisory and trivially ignored by many viewers.
Is my password sent anywhere?
No. The encryption runs in your browser. There's no server involved at any point, so there's nothing to intercept and nothing stored.
What happens if I forget it?
The file can't be opened, and we can't help — we never had the document or the password. Store it somewhere safe before you close the tab.
Is my PDF uploaded anywhere?
No. Every operation runs in your browser using JavaScript and WebAssembly — the file never leaves your device. You can verify it: load the page, disconnect from the internet, and the tool still works. There is no upload endpoint to send it to.

All PDF tools