How to password protect a PDF
- Add your PDF. Drop it onto the box above, or tap to choose a file.
- Choose a password. Type it in Password to open the PDF, then type it again in Type the password again. Use the eye button to check what you typed, and watch the strength meter.
- Set permissions (optional). Switch off Allow printing, Allow copying text and images or Allow editing if readers shouldn't do those things. Switch on Set a separate permissions password if you want to be able to change them later.
- Press Lock PDF, then download your locked copy with Download PDF.
Features
- AES-256 encryption, the strongest method in the PDF standard, for the whole file: pages, text, images and attachments.
- Open password with a confirmation box, so a typing mistake doesn't lock you out.
- Strength meter that flags short, repetitive and very common passwords.
- Show or hide each password with one tap.
- Optional restrictions on printing, copying and editing.
- Optional permissions password, separate from the open password.
- File size before and after, so you can see the locked file is about the same size as the original.
- Your original stays unchanged. You download a new copy with -locked added to its name.
Why use Fileora to lock a PDF
Most online PDF lockers ask you to upload the document and type the password into a web form, which means a stranger's server briefly holds both the file and the key to it. That defeats the point for exactly the documents you most want to protect: bank statements, payslips, contracts, medical reports and identity scans.
Fileora does the job in your browser instead. When you press Lock PDF, a copy of qpdf, a widely used open-source PDF toolkit, is loaded into the page as WebAssembly and encrypts the file on your device. Nothing is uploaded, nothing is stored, and there's no account, watermark or daily limit. It works on phones and tablets as well as computers.
If you're sending the file by email, it's often worth making it smaller first with compress PDF, or combining several documents into one with merge PDF, and locking the finished file last.
Choosing a password that holds up
AES-256 itself isn't going to be broken. What attackers do instead is guess the password, trying common passwords, dictionary words, names and dates at very high speed on a copy of the file. So the length and unpredictability of your password decide how safe the PDF really is.
- Go long. Twelve characters is a sensible minimum; a phrase of four or five unrelated words is both strong and easy to type.
- Avoid the obvious. Names, birthdays, phone numbers, the company name and keyboard patterns like qwerty are the first things guessed.
- Use a new password. Don't reuse one from an email or bank account.
- Send it separately. If you email the PDF, share the password by phone, text message or in person, not in the same email.
Permissions and the permissions password
The PDF standard lets a document carry permissions for printing, copying and editing. These are honoured by PDF readers rather than enforced by the encryption: someone who can open the file with a reader that ignores the rules can still print or copy it. Use them to discourage casual copying or accidental edits, not to protect secrets.
Switching off Allow editing also stops page changes, form filling and comments in readers that respect it. If you turn on the permissions password, keep it different from the open password; the tool will remind you if they match.
Good to know
Keep an unlocked original in a safe place, because a forgotten password can't be reset. If the PDF has a digital signature, locking it rewrites the file, so the old signature will no longer validate; lock first and sign afterwards. To take the password off again later, use unlock PDF with the password you set.