What kind of encryption is this?

RC4-128 — the older PDF password standard. It genuinely stops the document being opened without the password, and it is not modern encryption. We say so plainly because the engine that runs in your browser cannot do AES, and claiming otherwise would be a lie you might rely on.

So is it worth using?

For keeping a document away from casual access — a shared drive, a forwarded email, a colleague who should not read it — yes, and a long password makes it a real obstacle. For genuinely sensitive material facing someone determined, no. Put the PDF inside a 7-Zip or archive file with AES-256 instead, and send the password separately.

Is my password sent anywhere?

No, and this is the actual reason to use a browser-based tool for this job. Every server-side "protect PDF" service asks you to upload the confidential document AND the password that protects it, to a stranger, which defeats the purpose. Here both stay in this tab.

What if I forget the password?

The document is gone. Nothing about it is stored or transmitted, so there is no reset, no recovery and nobody to ask. Put it in your password manager before you click.

Can I stop people printing or copying instead?

The file records those restrictions, but they are advisory — the PDF specification lets any reader ignore them, and plenty do. We do not present them as protection, because they are not.

Password Protect a PDF — Free, No Upload

Add a password so a PDF cannot be opened without one. Runs in your browser, so neither the document nor the password is ever transmitted anywhere.

What this does

Adds a password to a PDF, so opening it requires typing that password. Both the document and the password stay in this browser tab.

What the protection is actually worth

This is the part most tools leave out, so here it is first.

It uses RC4-128, the older PDF password standard. It is what your PDF reader will prompt you for, and it genuinely prevents the file being opened by someone who does not have the password.

It is not modern encryption. RC4 is legacy, it has known weaknesses, and commercial password-recovery software exists specifically to break it — quickly, if the password is short.

We would rather write that sentence than the word "AES", which would be false. The engine that runs in your browser can only do RC4, and we would rather ship a tool that is honest about its limits than a claim you might rely on for something that matters.

So, in practice:

Keeping a file away from casual access — a shared folder, a forwarded email, someone borrowing your laptop — this does that, and a long password makes it a real obstacle.
Protecting genuinely sensitive material from someone motivated — it does not. Put the PDF inside a 7-Zip or archive file with AES-256, and send the password by a different channel.

Length beats complexity

The encryption is legacy, so your password is doing most of the work, and length is what makes a password expensive to attack. Sixteen ordinary characters beat eight clever ones with symbols in them.

The tool tells you which band you are in as you type. It refuses anything under eight characters, because below that the protection is decorative.

Why doing this in the browser is the whole point

Look at what a server-side password tool asks of you: upload the confidential document, and the password that protects it, to a company you have never dealt with. Whatever their policy says, you have just handed a stranger both halves.

Nothing here is uploaded. You can confirm it — open your browser's developer tools, watch the Network tab, and protect a file. You will see the engine download once and no upload of your document.

There is no recovery

Nothing about your password is stored, sent or recoverable. If you forget it, the document is gone, and there is nobody to appeal to.

Save it in your password manager first. This is the single most common way people lose a document permanently.

Printing and copying restrictions

A PDF can also record "do not print" or "do not copy" flags, and this tool sets them alongside the password. Understand what they are: advisory. The specification permits any reader to ignore them, and many do. They are a request, not a control, and are not presented here as protection.

This tool runs entirely inside your browser. Your file is never uploaded — it never leaves your device, so there is nothing for us or anyone else to read, store or leak.

Add a password to a PDF