Password-protect a PDF, or remove the password
Set an open password with AES-256, or remove an existing password if you know it. Both run entirely in your browser: the file and the password never leave your device, and nothing is stored. Pick the mode above, drop your PDF, type the password and download the result.
Why AES-256 and nothing else?
PDF has carried several encryption schemes over the years. The PDF 2.0 standard ISO 32000-2 marks the old ones, RC4 with 40 or 128 bits, as deprecated; AES-256 at encryption revision 6 is the only variant it does not label as deprecated. That is what this tool uses, with no option to pick anything weaker. A 40-bit option would only look like security.
Under the hood runs qpdf (version 12.2) as a WebAssembly module that we host ourselves. There is no request to a third-party CDN, and you can verify that in your browser's network tab.
How strong is a PDF password really?
Exactly as strong as your password, no stronger. PDF derives the key from your password with a fast hash chain, not with a memory-hard function like Argon2. Anyone holding the file can try candidates offline at very high speed, so a short or common password falls quickly.
The NIST guideline SP 800-63B (Digital Identity Guidelines) sets 8 characters as the minimum for user-chosen passwords and requires checking them against lists of known breached passwords, instead of prescribing rules like "one special character". We enforce those 8 characters as a hard floor, but recommend 12 or more and no word from a dictionary. The strength meter shows the entropy of a random password from that character pool, so for something like "Summer2024!" it is far too optimistic.
Open password or owner password?
The open password (user password) genuinely encrypts the content. Without it the file cannot be read, no matter which program you try.
An owner password encrypts nothing extra. It only sets flags such as "do not print" or "do not copy" that a program may honour but does not have to, and plenty of viewers ignore them. That is why we always require an open password and never call a document with restrictions alone "protected": it is readable by anyone. If you don't supply your own owner password, we reuse your open password for it, because an empty owner password lets any program change the permissions at will.
How do I remove a password?
In "Remove password" mode you enter the current open password. If it is correct you get the same file back without encryption. If it isn't, the tool says so plainly. There is deliberately no guessing, no dictionary and no "cracking" mode: removing a password only works with the right password. Use this only for documents you own or are allowed to open.
Where are the limits?
- A forgotten password is gone for good. Everything runs locally, we store nothing and hold no recovery key. There is no back door, not even for us.
- An existing digital signature becomes invalid. Encrypting or decrypting rewrites the file, and that is precisely what a signature covers.
- Special characters in passwords are risky. Umlauts and emoji work here, but some older programs encode them differently. For files you pass on, a long ASCII password is the safer choice.
- Very large files need memory. The PDF is processed inside the browser tab; on a phone a few hundred megabytes is the practical ceiling.
- Encryption is not redaction. Whoever may open the file sees everything inside it. For confidential passages within the document, use the redaction tool.
Privacy: why this has to run locally
Sending a password together with the document it unlocks to someone else's server is exactly the combination you should never upload. That does not happen here: the WebAssembly module works in your tab's memory, and the password lives only there, never in localStorage, never in the address bar, never in a log. Close the tab and it is gone.