How to Password Protect a PDF: Encryption and Security Guide

Why PDF Password Protection Matters

Every day, sensitive documents are shared as PDFs -- contracts, financial reports, medical records, legal filings, tax returns, and confidential business plans. Without protection, anyone who gets a copy of the file can open, copy, print, and redistribute its contents freely.

PDF password protection adds two layers of security: encryption (scrambling the file data so it cannot be read without a password) and permissions (controlling what recipients can do with the document even after opening it). Understanding these mechanisms and implementing them correctly is essential for anyone handling confidential information.

This guide covers everything from basic password protection to advanced encryption settings, permission management, and the realities of PDF security in 2026.

Understanding PDF Password Types

PDFs support two distinct types of passwords, each serving a different purpose.

User Password (Document Open Password)

The user password is required to open the PDF. Without it, the file cannot be read at all -- the content is encrypted and inaccessible.

When to use:

• Sending confidential documents to specific individuals
• Protecting sensitive files at rest (stored on a shared drive)
• Complying with data protection regulations (HIPAA, GDPR, etc.)
• Sharing financial or legal documents

Owner Password (Permissions Password)

The owner password controls what people can do with the document after opening it. You can restrict printing, copying text, editing, form filling, and more.

When to use:

• Distributing reports that should be viewable but not editable
• Sharing documents where you want to prevent copy/paste of content
• Publishing forms that should only be filled in, not modified
• Protecting intellectual property in shared documents

How They Work Together

Encryption Levels Explained

PDF encryption has evolved significantly over the years. The encryption level determines how hard it is to crack the password through brute force.

Which Encryption Level to Choose

For any document created in 2026, use AES 256-bit encryption. There is no practical reason to use anything weaker. AES 256-bit:

• Is used by governments and military organizations worldwide
• Has no known practical attacks (brute force would take billions of years)
• Is supported by all modern PDF readers
• Is the default in most current PDF tools

Compatibility Considerations

If you need to support very old PDF readers, AES 128-bit is the minimum acceptable standard. Never use RC4 encryption.

Method 1: Using Adobe Acrobat

Adobe Acrobat Pro is the most full-featured option for PDF security.

Set Passwords

1. Open the PDF in Acrobat Pro
2. Click File > Protect Using Password (or Tools > Protect)
3. Choose whether to require a password for viewing or editing
4. Enter and confirm the password
5. Set the encryption level (AES 256-bit recommended)
6. Click Apply

Advanced Permission Settings

In Tools > Protect > Encrypt with Password:

• Require a password to open the document -- Sets user password
• Restrict editing and printing -- Sets owner password
• Encryption level -- AES 256-bit
• Permissions -- Fine-grained control (see Permission Restrictions below)

Method 2: Using ConvertIntoMP4

ConvertIntoMP4's PDF tools include security features:

1. Upload your PDF to the PDF converter
2. Apply password protection settings
3. Download the encrypted PDF

For existing PDFs that need compression before or after encryption, use the PDF compressor.

Method 3: Using macOS Preview

macOS Preview can add basic password protection:

1. Open the PDF in Preview
2. Click File > Export as PDF
3. Click Show Details
4. Check Encrypt
5. Enter and verify a password
6. Click Save

Note: Preview only supports a user password (open password). For permission controls, use a different tool.

Method 4: Using qpdf (Command Line)

qpdf is a powerful, free command-line tool for PDF encryption.

Install

brew install qpdf  # macOS
sudo apt install qpdf  # Ubuntu/Debian

Set User Password Only

qpdf --encrypt user_password "" 256 -- input.pdf output.pdf

Set Both Passwords

qpdf --encrypt user_password owner_password 256 -- input.pdf output.pdf

Set Passwords with Permission Restrictions

qpdf --encrypt user_password owner_password 256 \
  --print=none \
  --modify=none \
  --extract=n \
  -- input.pdf output.pdf

Full Permission Control

qpdf --encrypt user_pass owner_pass 256 \
  --print=low \
  --modify=none \
  --extract=n \
  --annotate=y \
  --form=y \
  --modify-other=n \
  -- input.pdf output.pdf

Method 5: Using Python (PyPDF2 / pikepdf)

Using pikepdf (Recommended)

pip install pikepdf

import pikepdf

# Set user password (required to open)
pdf = pikepdf.open('input.pdf')
pdf.save('protected.pdf',
    encryption=pikepdf.Encryption(
        owner='owner_secret_password',
        user='user_password_to_open',
        R=6,  # AES-256 (Revision 6)
        allow=pikepdf.Permissions(
            print_lowres=True,
            print_highres=False,
            modify_annotation=True,
            modify_form=True,
            modify_assembly=False,
            modify_other=False,
            extract=False,
            accessibility=True
        )
    )
)
print("Protected PDF created successfully")

Batch Encrypt Multiple PDFs

import pikepdf
import os

def batch_encrypt(input_dir, output_dir, user_pass, owner_pass):
    os.makedirs(output_dir, exist_ok=True)
    pdf_files = [f for f in os.listdir(input_dir) if f.endswith('.pdf')]

    for filename in pdf_files:
        input_path = os.path.join(input_dir, filename)
        output_path = os.path.join(output_dir, filename)

        try:
            pdf = pikepdf.open(input_path)
            pdf.save(output_path,
                encryption=pikepdf.Encryption(
                    owner=owner_pass,
                    user=user_pass,
                    R=6
                )
            )
            print(f"Encrypted: {filename}")
        except Exception as e:
            print(f"Failed: {filename} - {e}")

batch_encrypt('./documents', './protected', 'read123', 'admin456')

Permission Restrictions in Detail

PDF permissions let you control specific actions at a granular level.

Available Permissions

Recommended Permission Profiles

Confidential Report:

Fillable Form:

Review Draft:

Removing PDF Passwords

There are legitimate reasons to remove passwords from PDFs you own -- for example, consolidating protected files or removing obsolete security from internal documents.

If You Know the Password

Using qpdf

qpdf --decrypt --password=your_password protected.pdf decrypted.pdf

Using pikepdf

import pikepdf

pdf = pikepdf.open('protected.pdf', password='your_password')
pdf.save('decrypted.pdf')

Using macOS Preview

1. Open the protected PDF and enter the password
2. Click File > Export as PDF
3. Save without checking the Encrypt option

If You Have the Owner Password Only

If a PDF has permission restrictions (owner password) but no user password (opens freely), you can remove the restrictions:

qpdf --decrypt protected.pdf unrestricted.pdf

Important Legal Note

Removing password protection from PDFs you do not own or are not authorized to access may violate copyright law, terms of service, or data protection regulations. Only remove passwords from documents you own or have explicit authorization to modify.

Password Strength Recommendations

The strength of your encryption is only as good as your password. A document encrypted with AES 256-bit but protected by the password "1234" is trivially crackable.

Password Guidelines

Best Practices

1. Use a passphrase -- Four or more random words are easier to remember and harder to crack than complex short passwords
2. Use a password manager -- Generate and store unique passwords for each document
3. Communicate passwords securely -- Never send the password in the same email as the PDF. Use a different channel (SMS, phone call, separate email)
4. Rotate passwords -- For long-lived documents, update passwords periodically
5. Document your passwords -- If you lose the password to an encrypted PDF, the content is effectively unrecoverable

The Reality of PDF Permission Security

It is important to understand the limitations of PDF permission restrictions (owner password only, no user password):

What Permission Restrictions Can Prevent

• Casual modification by non-technical users
• Accidental editing in standard PDF readers
• Easy copy/paste of protected content
• Printing when printing is disabled

What Permission Restrictions Cannot Prevent

• A determined user with specialized tools can often bypass permission-only restrictions
• Screen captures of the content
• Re-typing the visible content
• Using tools that ignore the permission flags

Permission restrictions are a deterrent, not a guarantee. For truly sensitive content, always use a user password (which encrypts the actual content) in addition to permission restrictions.

When Permission-Only Protection Is Sufficient

• Internal corporate documents where recipients are trusted
• Published reports where you want to discourage but not absolutely prevent copying
• Forms that should only be filled in, distributed to known users
• Documents protected by additional controls (DRM, access management systems)

Combining Security with Other PDF Operations

PDF security works well alongside other document operations:

Encrypt After Compression

Compress your PDF first for smaller file size, then apply encryption:

# Step 1: Compress
qpdf --optimize input.pdf compressed.pdf

# Step 2: Encrypt
qpdf --encrypt user_pass owner_pass 256 -- compressed.pdf final.pdf

Use the PDF compressor for the compression step.

Encrypt After Signing

If you need to both sign and encrypt a PDF:

1. Sign the PDF first (see our guide on how to sign a PDF online)
2. Then apply encryption

Signing after encryption can cause issues because some signature verification processes need to access the original document data.

Encrypt After Merging

When combining multiple documents into one protected PDF:

1. Merge the PDFs (see how to merge and split PDFs)
2. Apply encryption to the merged document

Regulatory Compliance

Different industries have specific requirements for document encryption:

For compliance purposes, AES 256-bit with strong passwords satisfies all current regulations. Document your encryption practices as part of your security policy.

Troubleshooting

"Password Required" When You Did Not Set One

Cause: Someone added a user password before sharing the file with you. Fix: Contact the document owner for the password.

Cannot Print Despite Knowing the Password

Cause: You are entering the user password, but the owner password set printing restrictions. Fix: Enter the owner password instead, or ask the document owner to provide an unrestricted version.

Encrypted PDF Will Not Open in Older Software

Cause: The encryption level (AES 256-bit R6) is not supported by the reader. Fix: Re-encrypt with AES 128-bit for backward compatibility, or update the PDF reader.

Password Rejected Despite Being Correct

Cause: Copy/paste introduced invisible characters, or the PDF reader has a bug. Fix: Type the password manually instead of pasting. Try a different PDF reader.

Wrapping Up

PDF password protection is a critical tool for securing confidential documents. Use AES 256-bit encryption with both user and owner passwords for maximum security. Implement permission restrictions to control what recipients can do with the document, and always communicate passwords through a separate, secure channel.

For the best workflow, prepare your document first -- compress it with the PDF compressor, sign it if needed, and then apply encryption as the final step. ConvertIntoMP4's PDF converter provides a convenient way to manage these operations from any device.

For related PDF security and management guides, explore how to sign a PDF online, how to reduce PDF file size, and our PDF accessibility guide.