How to Password-Protect a PDF (and How Secure It Really Is)

The short answer

To password-protect a PDF, open Lock PDF, drop in the file, type a password twice and click Protect & Download. You get a copy named with _protected that asks for the password before it opens, encrypted with 128-bit AES. How safe it is depends mostly on your password: a long, random one is very hard to guess, while a date of birth or mobile number can be cracked quickly by anyone who suspects it.

How the Lock PDF tool works

Here is exactly what happens when you protect a file:

You drop or choose a PDF (up to 50 MB).

You enter a password and confirm it. The password must be at least 4 characters, and both boxes must match. Tick Show password to check for typos.

The tool encrypts the PDF in your browser and downloads a new file. For salary-slip.pdf, the download is salary-slip_protected.pdf. Your original file is not changed.

Opening the new file in any standard PDF reader (a browser, Adobe Acrobat Reader, Preview on Mac) asks for the password first.

Because the work happens in your browser, the document and the password are not uploaded to a server. That is the main reason to use a browser-based tool for payslips, bank statements, medical reports and ID scans.

When we tested a file locked with the tool, it used the standard PDF security handler with AES-128 encryption for its contents, which mainstream PDF readers support.

What the password protects, and what it does not

The tool sets one password, which is used both to open the file and as the "owner" password that controls permissions. In practice that means:

• Without the password, the file cannot be opened or read. The text and images inside are encrypted, not just hidden.
• With the password, the person opening it has full access. Because the open password and the owner password are the same, most readers treat them as the owner, so printing and copying are allowed.

So think of this as "only people with the password can read it", not "people can read it but not print or copy it". If you need view-only restrictions, you need a tool that sets a separate owner password, and even then such restrictions are only respected by readers that choose to honour them.

How strong is PDF password protection?

The encryption itself is not the weak point. AES-128 is a widely used, well-studied cipher. The weak point is the password, because someone with the file can try passwords on their own computer as fast as their hardware allows, with no lockout after wrong attempts.

Password type	Example	Risk
Date of birth	15081990	High: only a few tens of thousands of likely dates
Mobile number	98xxxxxxxx	High: guessable by anyone who knows you
Name + year	ravi1990	High: common pattern, found in cracking word lists
One dictionary word	sunshine	Very high: tried first by cracking tools
4 random words	lamp-orbit-cactus-river	Low
16 random characters	made by a password generator	Very low

Some organisations send statements locked with a date of birth or part of an ID number because it is easy for the recipient to remember. That keeps casual eyes out, but it is not strong protection against someone who has the file and knows a little about you.

For a strong password, use the Password Generator, and test any password you make up yourself in the Password Strength Checker. The guide on what the strength score and crack time mean explains how to read the result.

How to share the password safely

Encrypting a file and then putting the password in the same email undoes the protection: anyone who gets the email gets both. Better options:

• Send the PDF by email and the password by text message, phone call or a different chat app.
• Agree a password in person for files you exchange regularly.
• For one-off files, use a fresh password each time rather than reusing an important one.
• Never reuse your email or banking password to lock a PDF.

Before you lock: get the file ready

Encryption does not shrink the file and it is harder to edit once locked, so finish everything else first:

Merge multiple documents into one with Merge PDF so you share a single locked file.

Compress it if it needs to fit an email or upload limit.

Mask sensitive numbers you do not need to share. For Aadhaar, see how to mask your Aadhaar card before sharing.

Lock it as the last step.

Troubleshooting

"Could not encrypt this PDF. If it is already encrypted, unlock it first."

The PDF already has a password or other protection. Remove it with Unlock PDF (you need to know the current password), then lock the unlocked copy with your new password.

"Password must be at least 4 characters."

The tool requires 4 or more characters. Use far more than that for anything sensitive.

"Passwords do not match."

The two boxes are different. Tick Show password, retype, and check for a stray space at the end.

The recipient says the file will not open

Check that they are typing the password exactly, including upper and lower case. If they use an old or unusual PDF app, ask them to try a current browser, which can open AES-encrypted PDFs.

I forgot the password

There is no recovery option. The password is never stored or sent anywhere, so nobody can retrieve it. Keep your unlocked original, or keep the password in a password manager.

Common mistakes

• Deleting the original after locking. If you forget the password, the locked copy is unreadable.
• Using a guessable password for a file that matters.
• Sending the password with the file in the same message.
• Expecting print or copy blocking. This tool protects opening, not what someone does after they open it.
• Locking before merging or compressing, then having to unlock to make changes.