Every week, contracts, salary slips, medical reports and bank statements travel over email as unprotected PDFs — readable by anyone who intercepts them. Password-protecting a PDF takes under a minute and closes most of that exposure. But most people misunderstand what the password actually does, pick passwords that fall in seconds, or lock themselves out of their own files. Here is how to do it properly.
Two different locks: open vs permission password
PDF security has two independent passwords and they do very different jobs. The open password (also called the user password) encrypts the file: without it, the document cannot be opened at all. The permission password (owner password) leaves the file readable but restricts actions like printing, copying text or editing. Crucially, many free PDF readers simply ignore permission restrictions — they are a request, not a lock. If a document must stay confidential, you need a real open password with encryption, not permissions alone.
How to protect a PDF step by step
Open the free protect PDF tool, upload your file, and set a strong open password — the tool encrypts the document in your workflow and returns a locked copy to download. Send the password through a different channel than the file itself: if the PDF goes by email, share the password over a call or messenger, never in the same email thread. Finally, test the locked file yourself before sending: open it fresh and confirm it asks for the password and that the content is intact.
Never email the password with the file. A locked PDF plus its password in the same inbox is just an unlocked PDF with extra steps.
What makes a PDF password strong
PDF password-cracking tools try billions of guesses per second, so short passwords are decoration. 'Rahul123' falls in seconds; a four-word passphrase like 'monsoon-tablet-courier-window' would take centuries. Aim for at least 14 characters mixing unrelated words, and never reuse birthdays, phone numbers or company names — attackers try those first because everyone uses them. A password manager removes the memorization problem entirely.
What 128-bit AES means in plain English
When a tool says it protects your PDF with 128-bit AES, it means the file is scrambled with a cipher that has 2^128 possible keys — a number so large that trying every combination would take longer than the age of the universe, even with all the world's computers working together. In practice, attackers never attack the cipher; they attack the password. They try dictionaries of common passwords, leaked password lists and personal details scraped from social media. That is why password choice, not encryption branding, decides your real security. Any reputable tool offering AES-128 or AES-256 is fine — your job is supplying a passphrase no list contains.
How to share the password safely
A strong password sent carelessly is a weak system. Follow three rules. One: separate channels — file by email, password by phone call, SMS or an in-person conversation, so intercepting one channel yields nothing usable. Two: unique per recipient where it matters — if five employees each get salary slips, five different passwords mean one leak does not expose everyone. Three: expiry of knowledge — for time-sensitive documents like interview letters or one-time reports, tell the recipient the password verbally and avoid writing it anywhere permanent on their side. Password managers with secure sharing features handle all three gracefully when both sides use one.
Limitations you should know
Honesty matters here. Standard PDF encryption (128-bit AES, which is what most tools including ours apply) stops casual snooping, lost-laptop scenarios and email interception cold. It does not stop a determined attacker with the right tools and time if your password is weak, and it does not control what an authorized recipient does with the file afterward — they can still forward it. For regulated or highly sensitive material, combine the password with proper access control on the sharing platform itself rather than relying on the PDF alone.
Protecting PDFs on a phone
No desktop nearby? The workflow is identical on mobile: open the protect PDF tool in your phone browser, upload from files or Google Drive, set the passphrase, and download the locked copy back to your device. Mobile keyboards make long passphrases annoying, so generate the phrase on a password manager and paste it in rather than typing. One caution: phones often keep the original unlocked file in Downloads alongside the protected one — delete the original or move it somewhere safe, or the protection is theater.
Locked yourself out? Removing a password
If you own the file and know the password, removing protection is trivial: open it once with the password and save an unlocked copy with the free unlock PDF tool. If you have genuinely forgotten the password, be aware that no legitimate free tool can magically recover strong encryption — any site claiming instant recovery of a strong password is either lying or attempting something shady. Keep a backup of important passwords in a manager to avoid this entirely.
Everyday situations, answered
Sending salary slips to employees? One protected PDF per person, each with a unique password, beats a single shared password. Sharing a signed contract for review? An open password plus disabled editing keeps the text stable while discussion happens over email. Merging several sensitive documents first? Combine them with merge PDF and then protect the single result rather than juggling five passwords. And if your locked file is too large to email, shrink it first with compress PDF — our guide to compressing without losing quality walks through that. For the reverse decision — when a locked layout hurts more than it helps — read PDF vs Word: which should you use.