To password-protect a PDF, you encrypt it with an open password (also called a user password) that anyone must enter to view the file. Optionally, you add an owner password that controls permissions such as printing, copying text, and editing. With modern AES-256 encryption and a strong open password, the contents are unreadable to anyone who does not know the password. You can do this on a Mac with Preview, from Microsoft Word when exporting, or in your browser with a tool that encrypts the file on your own device.
Because password protection is easy to misunderstand, this guide explains what each password actually does, what encryption can and cannot guarantee, and how to choose settings that fit your situation.
The two passwords in a PDF
The PDF format defines two separate passwords with very different jobs.
The open password (user password)
This is the password people usually mean. Without it, the file cannot be opened at all. When a PDF has an open password, its contents are encrypted, and any compliant viewer prompts for the password before showing anything.
Use an open password when the document itself is confidential: tax returns, medical records, contracts, payroll, or anything you would not want read if the email were forwarded to the wrong person.
The owner password (permissions password)
The owner password sets restrictions on what someone can do after opening the file, such as:
- Printing, or printing only at low resolution.
- Copying text and images.
- Editing content, adding comments or rearranging pages.
- Filling in form fields.
Here is the important part: permissions rely on the PDF software choosing to respect them. Mainstream viewers do, but a file that can be opened can, in principle, be processed by software that ignores the restrictions. Permissions are a clear statement of your intent and a speed bump for casual misuse, not strong protection. The open password is what provides real confidentiality.
How the two combine
- Open password only: the file is encrypted; anyone with the password can open it.
- Open password plus owner password: the file is encrypted, and restrictions apply to people who open it with the open password. Someone who enters the owner password gets full access.
- Owner password only: some tools allow this. The file opens without a prompt, and only the restrictions apply. Since no secret is needed to read it, the content is not confidential.
What AES-256 means
AES is the Advanced Encryption Standard, a widely used and well-studied encryption algorithm. The "256" refers to the key length in bits. PDF readers have supported AES-256 encryption for many years, and it is the strongest option in the PDF standard.
Older PDF encryption methods, such as 40-bit and 128-bit RC4, are considered weak today. If a tool offers a choice, prefer AES-256. Very old viewers may not open AES-256 files, but any reasonably current PDF app on desktop or mobile will.
The password is the weak point
Strong encryption does not help if the password is easy to guess. Attackers who get a copy of an encrypted file can try passwords offline as fast as their hardware allows. To make that impractical:
- Use a long password or passphrase. Several random words, or a password of 14 or more characters, is far stronger than a short, complex one.
- Avoid personal information such as birthdays, names or account numbers that could be found or guessed.
- Use a password manager to generate and store unique passwords.
- Share the password separately. If you email the PDF, send the password by text message, phone call or another channel. Putting it in the same email defeats the purpose.
Native ways to password-protect a PDF
Preview on a Mac
- Open the PDF in Preview.
- Choose File > Export.
- Depending on your macOS version, either tick Encrypt and enter a password, or click Permissions to set an open password, an owner password and allowed actions.
- Save under a new name.
Microsoft Word on Windows or Mac
If the document starts in Word, you can encrypt while exporting:
- Choose File > Save As (or Export) and select PDF as the format.
- On Windows, click Options and tick Encrypt the document with a password.
- Enter the password and save.
The exact options differ between versions, and the Mac version of Word may not offer this setting.
Adobe Reader and Windows
The free Adobe Reader cannot add passwords; that is a feature of the paid Acrobat product. Windows itself has no built-in way to encrypt a PDF, although you can protect files in other ways, such as encrypted archives or encrypted drives.
Password-protect a PDF in your browser
Our free Protect PDF tool encrypts your file with AES-256 directly on your device. The unprotected document and your password are never sent to a server, which is exactly what you want when the whole point is confidentiality.
- Open Protect PDF and add your PDF.
- Enter an open password. This is required, and it is what recipients will type to view the file.
- Optionally enter an owner password. If you leave it empty, the tool generates a random owner password behind the scenes, so the restrictions cannot be lifted by someone who only knows the open password.
- Choose permissions:
- Allow printing is on by default.
- Allow copying of text and images is off by default.
- Allow editing is off by default. This also covers adding comments and rearranging pages.
- Protect the file and download the encrypted copy.
Form filling remains allowed, so recipients can still complete fields in a protected form.
Choosing permissions sensibly
- Sending a contract for review: allow printing, disallow editing. The recipient can print and sign on paper but is discouraged from altering the text.
- Distributing a paid report or course material: disallow copying and editing. Consider adding a visible notice with Watermark PDF as well, since a watermark stays visible even if someone takes a screenshot.
- Sharing personal records with an accountant: a strong open password is what matters. Allow printing and copying so they can work with the numbers.
Remember that permissions are respected by compliant software, not enforced by mathematics. Choose them to express your intent, and rely on the open password for secrecy.
What password protection does not do
- It does not hide content from people who have the password. Anyone you share it with can read everything. If some information should never be seen, remove it with Redact PDF before sharing, which deletes the content under the black boxes rather than covering it.
- It does not remove metadata risks for authorized readers. Author names and software details remain visible once opened. Remove metadata before protecting the file if that matters.
- It does not prevent screenshots or photos of the screen. Nothing in a file format can.
- It does not help if you forget the password. There is no reset button. Store the password safely.
Recommended workflow for sensitive documents
- Finalize the content and remove anything that should not be shared, using redaction if necessary.
- Flatten filled forms with Flatten PDF if you do not want answers edited.
- Remove unnecessary metadata.
- Compress the file if it is large, because encryption should be the last step.
- Protect it with a strong open password and appropriate permissions.
- Send the file and the password through separate channels.
- Keep an unencrypted original in a safe place, such as an encrypted drive, so you are not locked out later.
Key takeaways
- The open password encrypts the file and is what actually keeps content confidential.
- The owner password sets permissions such as printing, copying and editing, which compliant viewers respect but which are not strong security on their own.
- AES-256 is the strongest encryption in the PDF standard, but a weak password undermines it; use a long passphrase and share it separately.
- Preview and Word can add passwords natively; the free Adobe Reader cannot.
- Our in-browser Protect PDF tool encrypts with AES-256 on your device and lets you control printing, copying and editing.