How to Protect a PDF with a Password

Password protection on a PDF does one thing: it makes the file impossible to open without the password. This is real encryption — the kind that cannot be bypassed by opening the file in a text editor. If you lose the password, the file is gone. There is no recovery, no back door, no "reset password" button.

This guide explains how PDF encryption works, how to choose a password you won't lose, and when password protection alone is not enough.

What "password protection" actually means

When you protect a PDF with a password, the file is encrypted using the AES algorithm. AES is the same standard used by banks, governments and secure messaging apps. It is considered unbreakable with current computing power at key lengths of 128 bits or higher.

The encryption key is derived from your password. If someone has the encrypted file but not the password, they cannot open the file. There is no shortcut — the file is genuinely scrambled until the correct password decrypts it.

What OmniPDF's Protect PDF does

OmniPDF uses the pdf-lib-encrypt library to add standard AES encryption to your PDF. The encryption happens entirely in your browser — your password and your file never leave your device. The output is a standard encrypted PDF that opens in any modern reader: Acrobat, Preview, Chrome, Firefox, Edge.

You can also set two separate passwords: a user password (required to open the file) and an owner password (required to change permissions or bypass restrictions). Most users only need the user password. Set an owner password if you want to restrict printing or copying in addition to opening.

Choosing a strong password

The security of encrypted PDFs depends entirely on the password. Common mistakes:

• Short passwords. Anything under 12 characters can be brute-forced in hours on modern hardware.
• Dictionary words. Any password made of real words is vulnerable to dictionary attacks.
• Reused passwords. If the same password appears in a data breach elsewhere, attackers try it first.
• Personal information. Names, dates, pet names and birthdays are the first things tried.

What a strong password looks like

A strong PDF password is:

• At least 16 characters long.
• Random — not based on a pattern.
• Unique — never used on any other account or document.
• Stored in a password manager, not in a notebook or a text file on the same device.

If you need to generate one, the PDF Password Generator produces cryptographically random passwords of any length using window.crypto.getRandomValues(). Nothing is logged or transmitted.

What happens if you forget the password

The file is gone. This is not a limitation of OmniPDF — it is how strong encryption works. If passwords were recoverable, encryption would be pointless.

Practical steps to avoid this:

1. Write the password in a password manager before you click Protect.
2. Test that the password works by opening the encrypted PDF immediately after creation.
3. If you are protecting a document someone else will need to open, share the password through a separate channel (phone call, in person) — not in the same email as the file.
4. Keep an unencrypted original until you have confirmed the encrypted copy opens with the password.

Permissions vs passwords

PDFs support two kinds of "protection" that are often confused:

• Encryption (password to open) — strong. The file cannot be read without the password. This is what Protect PDF does.
• Permissions (password to edit/copy/print) — weak. The file can be opened by anyone, but the PDF reader refuses certain actions like printing or copying. Determined users can bypass permissions with freely available tools.

If your goal is to prevent copying, permissions alone are not enough. If your goal is to prevent unauthorised opening, encryption is what you want.

Layers of protection

Real confidentiality usually needs more than one layer:

• Encryption — password-protects the file.
• Secure transmission — send the file over HTTPS or via an encrypted channel.
• Separate password delivery — send the password through a different channel than the file.
• Expiry — PDF does not support true expiry, but you can watermark a "confidential" notice so the receiver knows not to forward.

When to unlock a PDF you own

If you receive a PDF you own with a password and want to remove it, use Unlock PDF with the known password. OmniPDF does not and cannot crack unknown passwords.

Privacy

All encryption happens in your browser. The password and the document never leave your device. This is genuinely secure against server-side logging — there is no server to log anything.