How to password-protect a PDF without uploading it

The usual way to put a password on a PDF online is to send both the document and the password to somebody else’s server. Here the encryption runs in the tab, which removes that risk and moves another one onto you: there is nobody to ask afterwards. Most of getting it right is a few seconds of care either side of pressing the button.

User and owner passwords

A user password is the one a reader asks for before it will show the document at all. An owner password only restricts actions such as printing or copying once the document is open; readers are supposed to honour those restrictions, and many do not.

The tool sets one password and writes it as both. In protect in src/lib/pdf/ops.ts, the owner password falls back to the user password when none is given, and the page offers no second field. So treat the password as the protection, and any print or copy restriction, from this tool or another, as a polite request.

Protecting a PDF step by step

1. Store the password somewhere you will find it, before you start. There is no reset and no support route.
2. Open Protect PDF and choose Add a PDF. If the file already has a password, you are asked for it first, and the protected copy then carries only the new one, which makes this the way to change a PDF’s password as well.
3. Type the password into Password to set. There is no confirmation field, so a typing slip here becomes the password.
4. Press Protect PDF. A note confirms AES-256 and reminds you that nobody can recover the password. Download the copy, which has -protected added to its name.
5. Open the downloaded file in your usual reader and type the password. That check is the only guard against a slip in step 3, and it takes ten seconds.

What the encryption is

The tool encrypts through @cantoo/pdf-lib, whose default is AES-256: revision 6 of the standard PDF security handler, with the AESV3 crypt filter. It draws a random 32-byte key, which is 32 × 8 = 256 bits, encrypts the document with it, and stores that key in the file only in wrapped form, sealed under the password. Files made this way open in current Acrobat, Preview, Chrome and Firefox.

RC4, the older cipher, is refused. The library will not use it unless code explicitly asks, and its error message gives the reason: “RC4 is broken and was removed from ISO 32000-2.” The tool never asks. Some uploading services still produce RC4-protected files, which prompt for a password in exactly the same way, so the prompt alone tells you nothing about the cipher behind it.

Encryption covers the file’s strings and streams, which hold the text and drawing data, and leaves its object structure readable. A reader can still tell how many pages a protected PDF has and what size they are; what it cannot do without the password is turn the page content into anything readable.

Methods compared

	This tool	qpdf on the command line	A typical uploading service
Where the password is used	Your browser	Your computer	Their server
Cipher	AES-256	AES-256, with 256 in the command	Varies; some still RC4
Document held elsewhere	Never received	Never sent	Held for 1–2 hours
Recovery if the password is lost	None	None	None, and rarely stated

The two ways protection fails

The password is lost

A protected PDF whose password is lost is lost. The password never reaches this site, which is the point of doing it in the browser, and it also means there is no backdoor, no reset and nobody who can help. Step 1 exists for this reason.

A later edit quietly removes it

Every editing tool on this site that is handed a protected file asks for the password, works on a decrypted copy and returns a result with no password: crop, page numbers, watermark, merge and the rest. The workbench source says so in as many words, decrypting the document once so that every editing operation receives plain bytes. That makes the order simple: finish every edit, then protect the final file.

Some tools elsewhere fail in a worse way. A merger that skips decryption copies the protected pages while they are still encrypted; in our measurement of merging encrypted PDFs, all three protected pages came out blank and only 49 of 373 characters survived, with no error shown.

Other ways to protect a PDF

With qpdf, this command writes an AES-256 copy, where USERPW opens the file and OWNERPW is the owner password:

qpdf --encrypt USERPW OWNERPW 256 -- input.pdf locked.pdf

That is the route if you want the two passwords to differ. On a Mac, Preview’s File → Export saves a copy, and its export options can add a password.

Checking the password stayed local

Encryption is local, and you can watch it stay local. Open the Network tab in your browser’s developer tools, then add the PDF; the tool’s PDF code downloads at that moment. Type the password and press the button, and no request appears carrying the document or the password. Going offline after adding the file and protecting it anyway makes the same point.

Protect the final copy

Protect PDF encrypts with AES-256 and keeps the password in your tab. If you later need the protection off a file you hold the password for, Unlock PDF does it, and how to remove a password from a PDF you can already open explains what that copy keeps.