Secure PDF
Add password protection with AES-256 encryption to PDF documents.
Secure PDF
Encrypt, decrypt, or sanitize PDF files β all processed client-side in your browser.
Drop a PDF file here
or click to browse
How to Use the Secure PDF Tool
A human resources department sends employment contracts as PDFs that must remain confidential. Open this tool, drag a contract PDF onto the drop zone, set an open password so only the employee can view it, set a permissions password to prevent printing or copying, select AES-256 encryption, and click Encrypt and Download. The tool applies the encryption and permission flags using pdf-lib entirely in your browser. The resulting PDF requires the password to open and enforces the permission restrictions in compliant readers like Adobe Acrobat.
A law firm sends a discovery document that opposing counsel should view but not copy or modify. Upload the PDF, set an open password, disable the Copy text and Modify content permissions, and click Encrypt and Download. The encrypted PDF opens with the password but blocks text selection and editing in compliant readers. The firm retains the permissions password to change settings later if needed.
A company migrates 500 password-protected PDFs to a new document management system and needs to strip the passwords for bulk processing. Upload each PDF, switch to the Decrypt tab, enter the known password, and click Decrypt and Download. The tool produces an unprotected copy that opens without a password. This works for both user passwords and owner passwords.
A journalist receives a leaked PDF that contains hidden metadata including the original author name and creation date. Upload the file, switch to the Sanitize tab, and click Sanitize and Download. The tool strips the Title, Author, Subject, Keywords, Producer, Creator, Creation Date, Modification Date, and XMP metadata stream. The output PDF contains no identifying metadata that could trace back to the source.
A CFO needs to send an encrypted quarterly earnings PDF to the board before the public announcement. Upload the PDF, set a strong open password, allow printing but disable copying and modifying, select AES-256 encryption, and click Encrypt and Download. The board members receive the password separately and can open, read, and print the document but cannot copy text or modify the contents.
How the Secure PDF Tool Works
All encryption, decryption, and sanitisation happens locally in your browser using pdf-lib. Your files never leave your device and no data is sent to any server.
PDF Encryption Standards
When you encrypt a PDF, the tool applies industry-standard AES-256 or RC4-128 encryption to the document content streams. AES-256 uses a 256-bit key with cipher-block-chaining mode, making it resistant to brute-force attacks. RC4-128 is a legacy stream cipher supported for backward compatibility with older PDF readers. Both algorithms encrypt the raw PDF data so the content is unreadable without the correct password.
Permission Flags
Each PDF stores a set of permission flags in its encryption dictionary. These bit-level flags control what actions are allowed: printing, copying text, modifying content, and adding annotations. When a user opens the PDF with only the user password, compliant PDF readers read these flags and enforce the restrictions. The owner password is required to change these permission settings or re-encrypt the document.
Password Protection Levels
A PDF can have two distinct passwords: the user password, also called the open password, which is required to open and view the document, and the owner password, also called the permissions password, which grants full control over the document including the ability to change permissions and remove encryption. If only the owner password is set, the PDF opens freely but permission restrictions are enforced.
Frequently Asked Questions
What encryption standard does this tool use?
The tool supports AES-256, AES-128, and RC4-128 encryption. AES-256 is the strongest option and is recommended for most use cases because it uses a 256-bit key with cipher-block-chaining mode. RC4-128 is provided only for compatibility with very old PDF readers that do not support AES encryption.
What is the difference between an owner password and a user password?
The user password, also called the open password, is required to open and view the PDF. The owner password, also called the permissions password, controls access to permission settings and allows changing or removing encryption. If only the owner password is set, the PDF opens without a prompt but restrictions like print or copy bans are still enforced by compliant readers.
Can I remove a password from a PDF later?
Yes. Use the Decrypt tab and enter the correct password to produce an unprotected copy of the PDF. You must know the password because this tool does not attempt to crack or brute-force protected files. The decrypted output is a standard PDF that opens without any password prompt in any viewer.
Are there file size limits?
Since all processing happens in your browser memory, very large files of hundreds of megabytes may cause slow performance or run out of memory. For most PDFs under 100 MB, the tool works smoothly without issues. The encryption process itself adds negligible overhead to the file size.
Does encryption affect the visual quality of my PDF?
No. Encryption only scrambles the raw data streams, it does not alter fonts, images, layouts, or any visible content. When decrypted, the PDF renders exactly as it did before encryption. The encryption process is purely a data-layer operation that does not touch the visual rendering pipeline.
Will the encrypted PDF work in all PDF readers?
AES-256 encryption is supported by all modern PDF readers including Adobe Acrobat, Chrome, Firefox, and Preview on macOS. If you need compatibility with very old readers from before 2010, choose RC4-128. Note that permission restrictions are advisory, most compliant readers enforce them, but some viewers may ignore them.