Protect PDF

Some documents are not meant for everyone — bank statements, contracts, payslips, medical letters and confidential reports all benefit from an extra lock. Protect PDF adds a password to your document so that only people who know it can open and read the contents, giving you a simple layer of security before you email or upload a sensitive file.

Encrypting a PDF is especially worthwhile when you are sending it over email or sharing it through a service you do not fully control, where the file could be forwarded or intercepted.

PDF supports two different passwords and conflating them is the most common mistake in document security. An open password (sometimes called a user password) is required to view the document at all, and it is backed by genuine encryption — without it there is nothing readable in the file. A permissions password (owner password) leaves the document freely openable and merely sets flags requesting that viewers disallow printing or copying.

Those permission flags are advisory. Compliant readers honour them, which is why they appear to work, but plenty of software ignores them and removing them is trivial.

So if you need a document to be genuinely unreadable without a password, you need an open password. Adding only a permissions password gives you an inconvenience, not a protection — a distinction worth understanding before you rely on it for something confidential.

The encryption is only ever as strong as the password in front of it. AES protecting the word 'invoice2026' is a very good lock on a door with a predictable key, because attacks work through dictionaries and common patterns rather than brute-forcing every combination.

Length matters more than complexity. A passphrase of several unrelated words is both stronger and easier to convey over the phone than a short string of substituted characters.

Write it down somewhere you will still have it later. There is no recovery mechanism and no back door — that is the entire point of the feature. A protected document whose password has been lost is, for practical purposes, gone.

This undoes the protection completely, and it happens constantly. Emailing an encrypted attachment with the password in the body of the same message means anyone who reads the email has both halves.

Send the document one way and the password another: a phone call, a text message, a different messaging platform. It takes thirty seconds and it is the difference between real protection and the appearance of it.

Do not use predictable passwords either — a date of birth, a postcode, an account number. Recipients being able to guess is a feature only when you intended it.

Encryption is performed entirely in your browser, so neither the document nor the password is transmitted anywhere. That property is particularly relevant here: uploading a confidential file to a third-party server in order to secure it involves exactly the exposure you were trying to prevent.

One limitation worth stating plainly: once an authorised person opens the document, they can copy, screenshot or retype its contents. Encryption controls who can open a file. No PDF feature controls what a reader does with information they can already see.