Password-protect a PDF — real AES-128 encryption
Add a password to a PDF so it cannot be opened without one. The encryption is real AES-128, applied in your browser — the file and the password never leave your device.
Runs in your browser — your input is not uploaded to ToolsNow.
Your files are processed locally in your browser and are not uploaded to ToolsNow.
What the encryption actually is. The protected copy uses the PDF standard security handler with AES-128 (revision 4) — verified by reading the generated file, not assumed from documentation. That is genuine encryption: without the password the contents cannot be read, and this page will not claim AES-256, which the library does not produce.
Permissions are a different thing entirely. The two options above set flags asking readers not to print or copy. They are requests, not enforcement: the file is decrypted once the password is accepted, so software that chooses to ignore the flags can print and copy freely. Treat them as a courtesy label, never as protection.
The password is used in this page and is never sent anywhere, stored, or written to the console. It is cleared from the form as soon as the protected file is produced — which also means there is no recovery: if you lose the password, the document is unrecoverable. Keep your original file until you have confirmed the protected copy opens.
How to use
- Choose a PDF. It must not already be password-protected; unlock it first if it is.
- Set a password. Type it twice, or generate a strong one. The strength readout shows how much guessing it would take.
- Protect and download. An encrypted copy downloads. Your original is untouched.
Questions
What encryption is actually applied?
The PDF standard security handler with AES-128 (revision 4). That is verified by reading the bytes of a generated file rather than taken on trust, and it is why this page does not claim AES-256 — the library used here does not produce it. AES-128 is not broken and is not the weak link; the strength of your password is.
What is the difference between the password and the permission options?
They are completely different in kind. The password encrypts the document: without it, the contents are unreadable. The permission flags — do not print, do not copy — are requests recorded in the file. Once the password is accepted the document is decrypted, so any software that chooses to ignore those flags can print and copy freely. Treat permissions as a courtesy label, never as protection.
What happens if I lose the password?
The document is unrecoverable. There is no master key, no reset and no back door — that is what makes the encryption meaningful. Keep the original unprotected file, or store the password in a password manager, before you send the protected copy anywhere.
Is my password sent anywhere?
No. It is used by code running in this page, never transmitted, never stored, and never written to the browser console. It is also cleared from the form as soon as the protected file is produced, so it does not linger in the page if you walk away.
Will the protected file open everywhere?
AES-128 has been part of the PDF specification since Acrobat 7 (2005), so essentially every current reader supports it — Acrobat, Preview, Chrome, Edge, Firefox and the common mobile readers. Very old software may not. Test the file opens before relying on it.