How to Password Protect a PDF: Encryption and Security Guide

Why PDF Password Protection Matters

Every day, sensitive documents are shared as PDFs -- contracts, financial reports, medical records, legal filings, tax returns, and confidential business plans. Without protection, anyone who gets a copy of the file can open, copy, print, and redistribute its contents freely.

PDF password protection adds two layers of security: encryption (scrambling the file data so it cannot be read without a password) and permissions (controlling what recipients can do with the document even after opening it). Understanding these mechanisms and implementing them correctly is essential for anyone handling confidential information.

This guide covers everything from basic password protection to advanced encryption settings, permission management, and the realities of PDF security in 2026.

PDF document with a lock icon showing encryption and password protection layers

Understanding PDF Password Types

PDFs support two distinct types of passwords, each serving a different purpose.

User Password (Document Open Password)

The user password is required to open the PDF. Without it, the file cannot be read at all -- the content is encrypted and inaccessible.

When to use:

Sending confidential documents to specific individuals
Protecting sensitive files at rest (stored on a shared drive)
Complying with data protection regulations (HIPAA, GDPR, etc.)
Sharing financial or legal documents

Owner Password (Permissions Password)

The owner password controls what people can do with the document after opening it. You can restrict printing, copying text, editing, form filling, and more.

When to use:

Distributing reports that should be viewable but not editable
Sharing documents where you want to prevent copy/paste of content
Publishing forms that should only be filled in, not modified
Protecting intellectual property in shared documents

How They Work Together

Configuration	Open Password	Permissions Password	Result
User only	Set	Not set	Must enter password to open; full permissions once opened
Owner only	Not set	Set	Opens freely; restricted actions require owner password
Both	Set	Set	Must enter user password to open; permissions restricted unless owner password used
Neither	Not set	Not set	No protection

Pro Tip: Always set both passwords when protecting confidential documents. A document with only an owner password (permissions only) can be opened by anyone -- the content encryption is weak because the file must be decryptable without a password. A user password ensures strong encryption of the actual content.

Encryption Levels Explained

PDF encryption has evolved significantly over the years. The encryption level determines how hard it is to crack the password through brute force.

Encryption	Key Length	PDF Version	Security Level	Notes
RC4 40-bit	40 bits	PDF 1.1+	Obsolete	Crackable in seconds
RC4 128-bit	128 bits	PDF 1.4+	Weak	Considered insecure
AES 128-bit	128 bits	PDF 1.5+	Good	Acceptable for most uses
AES 256-bit	256 bits	PDF 1.7+	Excellent	Recommended standard
AES 256-bit (R6)	256 bits	PDF 2.0	Best	Latest standard, strongest

Which Encryption Level to Choose

For any document created in 2026, use AES 256-bit encryption. There is no practical reason to use anything weaker. AES 256-bit:

Is used by governments and military organizations worldwide
Has no known practical attacks (brute force would take billions of years)
Is supported by all modern PDF readers
Is the default in most current PDF tools

Compatibility Considerations

PDF Reader	AES 128-bit	AES 256-bit	AES 256-bit (R6)
Adobe Acrobat DC	Yes	Yes	Yes
Adobe Reader DC	Yes	Yes	Yes
macOS Preview	Yes	Yes	Yes
Chrome PDF Viewer	Yes	Yes	Yes
Firefox PDF Viewer	Yes	Yes	Yes
Foxit Reader	Yes	Yes	Yes
SumatraPDF	Yes	Yes	Yes
Older readers (pre-2015)	Yes	Maybe	No

If you need to support very old PDF readers, AES 128-bit is the minimum acceptable standard. Never use RC4 encryption.

Method 1: Using Adobe Acrobat

Adobe Acrobat Pro is the most full-featured option for PDF security.

Set Passwords

Open the PDF in Acrobat Pro
Click File > Protect Using Password (or Tools > Protect)
Choose whether to require a password for viewing or editing
Enter and confirm the password
Set the encryption level (AES 256-bit recommended)
Click Apply

Advanced Permission Settings

In Tools > Protect > Encrypt with Password:

Require a password to open the document -- Sets user password
Restrict editing and printing -- Sets owner password
Encryption level -- AES 256-bit
Permissions -- Fine-grained control (see Permission Restrictions below)

Method 2: Using ConvertIntoMP4

ConvertIntoMP4's PDF tools include security features:

Upload your PDF to the PDF converter
Apply password protection settings
Download the encrypted PDF

For existing PDFs that need compression before or after encryption, use the PDF compressor.

Method 3: Using macOS Preview

macOS Preview can add basic password protection:

Open the PDF in Preview
Click File > Export as PDF
Click Show Details
Check Encrypt
Enter and verify a password
Click Save

Note: Preview only supports a user password (open password). For permission controls, use a different tool.

Method 4: Using qpdf (Command Line)

qpdf is a powerful, free command-line tool for PDF encryption.

Install

brew install qpdf  # macOS
sudo apt install qpdf  # Ubuntu/Debian

Set User Password Only

qpdf --encrypt user_password "" 256 -- input.pdf output.pdf

Set Both Passwords

qpdf --encrypt user_password owner_password 256 -- input.pdf output.pdf

Set Passwords with Permission Restrictions

qpdf --encrypt user_password owner_password 256 \
  --print=none \
  --modify=none \
  --extract=n \
  -- input.pdf output.pdf

Full Permission Control

qpdf --encrypt user_pass owner_pass 256 \
  --print=low \
  --modify=none \
  --extract=n \
  --annotate=y \
  --form=y \
  --modify-other=n \
  -- input.pdf output.pdf

Terminal showing qpdf command encrypting a PDF with AES 256-bit and permission flags

Method 5: Using Python (PyPDF2 / pikepdf)

Using pikepdf (Recommended)

pip install pikepdf

import pikepdf

# Set user password (required to open)
pdf = pikepdf.open('input.pdf')
pdf.save('protected.pdf',
    encryption=pikepdf.Encryption(
        owner='owner_secret_password',
        user='user_password_to_open',
        R=6,  # AES-256 (Revision 6)
        allow=pikepdf.Permissions(
            print_lowres=True,
            print_highres=False,
            modify_annotation=True,
            modify_form=True,
            modify_assembly=False,
            modify_other=False,
            extract=False,
            accessibility=True
        )
    )
)
print("Protected PDF created successfully")

Batch Encrypt Multiple PDFs

import pikepdf
import os

def batch_encrypt(input_dir, output_dir, user_pass, owner_pass):
    os.makedirs(output_dir, exist_ok=True)
    pdf_files = [f for f in os.listdir(input_dir) if f.endswith('.pdf')]

    for filename in pdf_files:
        input_path = os.path.join(input_dir, filename)
        output_path = os.path.join(output_dir, filename)

        try:
            pdf = pikepdf.open(input_path)
            pdf.save(output_path,
                encryption=pikepdf.Encryption(
                    owner=owner_pass,
                    user=user_pass,
                    R=6
                )
            )
            print(f"Encrypted: {filename}")
        except Exception as e:
            print(f"Failed: {filename} - {e}")

batch_encrypt('./documents', './protected', 'read123', 'admin456')

Pro Tip: When encrypting PDFs programmatically, never hardcode passwords in your source code. Use environment variables, a secrets manager (like AWS Secrets Manager or HashiCorp Vault), or a configuration file with restricted permissions. Passwords in source code end up in version control and are visible to anyone with repo access.

Permission Restrictions in Detail

PDF permissions let you control specific actions at a granular level.

Available Permissions

Permission	Description	Common Setting
Print (high resolution)	Allow printing at full quality	Allow for most documents
Print (low resolution)	Allow printing at degraded quality	Compromise option
Modify content	Allow text and image editing	Deny for final documents
Copy/extract text	Allow selecting and copying text	Deny for confidential content
Add/modify annotations	Allow comments and markups	Allow for review documents
Fill form fields	Allow form completion	Allow for forms
Assemble document	Allow page insertion/deletion/rotation	Deny for most documents
Accessibility	Allow screen reader access	Always allow

Recommended Permission Profiles

Confidential Report:

Permission	Setting
Print high-res	Allowed
Print low-res	Allowed
Modify content	Denied
Copy/extract	Denied
Annotations	Denied
Fill forms	Denied
Assemble	Denied
Accessibility	Allowed

Fillable Form:

Permission	Setting
Print high-res	Allowed
Print low-res	Allowed
Modify content	Denied
Copy/extract	Allowed
Annotations	Denied
Fill forms	Allowed
Assemble	Denied
Accessibility	Allowed

Review Draft:

Permission	Setting
Print high-res	Denied
Print low-res	Denied
Modify content	Denied
Copy/extract	Denied
Annotations	Allowed
Fill forms	Denied
Assemble	Denied
Accessibility	Allowed

Removing PDF Passwords

There are legitimate reasons to remove passwords from PDFs you own -- for example, consolidating protected files or removing obsolete security from internal documents.

If You Know the Password

Using qpdf

qpdf --decrypt --password=your_password protected.pdf decrypted.pdf

Using pikepdf

import pikepdf

pdf = pikepdf.open('protected.pdf', password='your_password')
pdf.save('decrypted.pdf')

Using macOS Preview

Open the protected PDF and enter the password
Click File > Export as PDF
Save without checking the Encrypt option

If You Have the Owner Password Only

If a PDF has permission restrictions (owner password) but no user password (opens freely), you can remove the restrictions:

qpdf --decrypt protected.pdf unrestricted.pdf

Important Legal Note

Removing password protection from PDFs you do not own or are not authorized to access may violate copyright law, terms of service, or data protection regulations. Only remove passwords from documents you own or have explicit authorization to modify.

Password Strength Recommendations

The strength of your encryption is only as good as your password. A document encrypted with AES 256-bit but protected by the password "1234" is trivially crackable.

Password Guidelines

Factor	Weak	Acceptable	Strong
Length	Under 8 characters	8-12 characters	16+ characters
Character types	Letters only	Letters + numbers	Letters + numbers + symbols
Pattern	Dictionary word	Modified word	Random/passphrase
Example	`password`	`P@ssw0rd2026`	`correct-horse-battery-staple`
Brute force time	Seconds	Days to months	Centuries

Best Practices

Use a passphrase -- Four or more random words are easier to remember and harder to crack than complex short passwords
Use a password manager -- Generate and store unique passwords for each document
Communicate passwords securely -- Never send the password in the same email as the PDF. Use a different channel (SMS, phone call, separate email)
Rotate passwords -- For long-lived documents, update passwords periodically
Document your passwords -- If you lose the password to an encrypted PDF, the content is effectively unrecoverable

Diagram showing password strength spectrum from weak to strong with estimated crack times

The Reality of PDF Permission Security

It is important to understand the limitations of PDF permission restrictions (owner password only, no user password):

What Permission Restrictions Can Prevent

Casual modification by non-technical users
Accidental editing in standard PDF readers
Easy copy/paste of protected content
Printing when printing is disabled

What Permission Restrictions Cannot Prevent

A determined user with specialized tools can often bypass permission-only restrictions
Screen captures of the content
Re-typing the visible content
Using tools that ignore the permission flags

Permission restrictions are a deterrent, not a guarantee. For truly sensitive content, always use a user password (which encrypts the actual content) in addition to permission restrictions.

When Permission-Only Protection Is Sufficient

Internal corporate documents where recipients are trusted
Published reports where you want to discourage but not absolutely prevent copying
Forms that should only be filled in, distributed to known users
Documents protected by additional controls (DRM, access management systems)

Combining Security with Other PDF Operations

PDF security works well alongside other document operations:

Encrypt After Compression

Compress your PDF first for smaller file size, then apply encryption:

# Step 1: Compress
qpdf --optimize input.pdf compressed.pdf

# Step 2: Encrypt
qpdf --encrypt user_pass owner_pass 256 -- compressed.pdf final.pdf

Use the PDF compressor for the compression step.

Encrypt After Signing

If you need to both sign and encrypt a PDF:

Sign the PDF first (see our guide on how to sign a PDF online)
Then apply encryption

Signing after encryption can cause issues because some signature verification processes need to access the original document data.

Encrypt After Merging

When combining multiple documents into one protected PDF:

Merge the PDFs (see how to merge and split PDFs)
Apply encryption to the merged document

Regulatory Compliance

Different industries have specific requirements for document encryption:

Regulation	Minimum Encryption	Password Requirements	Additional Notes
HIPAA (Healthcare)	AES 128-bit	Strong passwords required	PHI must be encrypted at rest and in transit
GDPR (EU Privacy)	"Appropriate" encryption	Not specified	AES 256-bit recommended
PCI DSS (Payment)	AES 128-bit minimum	Complex passwords required	Applies to documents containing cardholder data
SOX (Financial)	AES 128-bit minimum	Varies by implementation	Audit trail requirements
FERPA (Education)	"Reasonable" security	Not specified	Student records must be protected

For compliance purposes, AES 256-bit with strong passwords satisfies all current regulations. Document your encryption practices as part of your security policy.

Troubleshooting

"Password Required" When You Did Not Set One

Cause: Someone added a user password before sharing the file with you. Fix: Contact the document owner for the password.

Cannot Print Despite Knowing the Password

Cause: You are entering the user password, but the owner password set printing restrictions. Fix: Enter the owner password instead, or ask the document owner to provide an unrestricted version.

Encrypted PDF Will Not Open in Older Software

Cause: The encryption level (AES 256-bit R6) is not supported by the reader. Fix: Re-encrypt with AES 128-bit for backward compatibility, or update the PDF reader.

Password Rejected Despite Being Correct

Cause: Copy/paste introduced invisible characters, or the PDF reader has a bug. Fix: Type the password manually instead of pasting. Try a different PDF reader.

Wrapping Up

PDF password protection is a critical tool for securing confidential documents. Use AES 256-bit encryption with both user and owner passwords for maximum security. Implement permission restrictions to control what recipients can do with the document, and always communicate passwords through a separate, secure channel.

For the best workflow, prepare your document first -- compress it with the PDF compressor, sign it if needed, and then apply encryption as the final step. ConvertIntoMP4's PDF converter provides a convenient way to manage these operations from any device.

For related PDF security and management guides, explore how to sign a PDF online, how to reduce PDF file size, and our PDF accessibility guide.