Password protect a PDF: encrypt and set permissions

by

Do you want to send a PDF that only the recipient can open, or stop it from being printed or copied? With PDF24 you can password protect PDFs for free: online in your browser or offline with PDF24 Creator for Windows, even while you create them. This page explains which password does what, what permissions can and cannot do, and what to keep in mind with email, PDF/A and forms.

Contents

Which way suits you?

  • Protect a finished PDF quickly, on any device: online with Protect PDF → step by step
  • No internet, the file stays on your PC: in the PDF24 Toolbox with "Protect PDF" → Toolbox
  • You are creating the PDF by printing: save it with a password right away in the PDF24 Assistant → PDF printer and profiles
  • Many files or the same settings again and again: your own output profile or the command line
  • A form you made should stay fillable but must not be changed: protect a form from changes
  • You are editing the PDF online anyway: in Edit PDF, set a "Password to open" in the "Protect" sidebar. For permissions, enter an "Owner password (for permissions)" of its own and untick under "Allowed actions" what should not be allowed. The PDF is protected when you save it.

The online tools work on Windows, Mac, Linux, iPhone and Android. The free PDF24 Creator with the Toolbox and the PDF printer is available for Windows.

Open password or permissions: the important difference

A PDF can have two different passwords. Their names differ a little from tool to tool:

  • Password to open (online "Password to open the PDF", in the Toolbox and the Assistant "User password"): without it, the PDF cannot be opened. The content is encrypted. Only this password really protects the content.
  • Password for the permissions ("Owner password" everywhere): it controls who may change the permissions, such as a ban on printing or copying. It is not needed to open the file.

This gives three useful combinations:

  1. Only people who know the password may read it: set a password to open, leave all permissions ticked.
  2. Anyone may read it, but not print or copy it: no password to open, but an owner password, and untick what should not be allowed.
  3. Readable only with a password, and then no printing or copying either: set both passwords, and make them different.

Important: if you want to restrict printing or copying and still be able to change the restrictions yourself later, set an owner password of its own and keep it to yourself. If you leave the field empty:

  • Online in Protect PDF: if permissions are restricted, PDF24 sets a random owner password. The restrictions then apply to everyone, including you, and can no longer be lifted later (see Forgot the password?). The note below the field says so too.
  • In the Toolbox, the Assistant and when you right-click (PDF24 Creator up to 11.34): PDF24 uses the password to open for the permissions as well. Anyone who opens the PDF with that password then has all rights, and the permissions you unticked do not apply. If you set no password at all there, only permissions, PDF24 creates a random owner password. With the next version of PDF24 Creator, the online rule applies there too.
  • All permissions allowed: the password to open also counts as the owner password, as before.

A good password is long and hard to guess, for example one from Generate password. Keep it somewhere safe, such as a password manager.

Protect a PDF online: step by step

  1. Open Protect PDF.
  2. Click "Choose files" or drag the PDF into the file box. Several files are protected in one go, each on its own and with the same settings. Word files, images and other files are converted to PDF first.
  3. Enter the "Password to open the PDF". Use the eye to the left of the field ("Show password") to check for typos; there is no second field to confirm it.
  4. Permissions and the owner password are behind the gear to the right of the field ("Additional options"). If you don't need any restrictions, leave them as they are.
  5. Click "Protect PDF files", then "Download", or send the file straight away with "Email".

Setting permissions (gear):

  1. Click the gear. The "Additional options" window has the field "Owner password" at the top and the permissions below. All of them are ticked, i.e. allowed.
  2. Enter an owner password that is different from the password to open. If you leave it empty, PDF24 sets a random password as soon as you restrict a permission; you can then no longer change the restrictions.
  3. Untick everything that should not be allowed, e.g. "Printing" and "Copying of contents". What each one means is explained under What the permissions do.
  4. Close the window and click "Protect PDF files".

If you have just used another tool, for example merged PDFs, you don't need to download the result first: click "Continue with..." below the result and choose "Protect PDF". Your files are transferred encrypted and deleted from the PDF24 server automatically after one hour.

Offline in the PDF24 Toolbox

  1. Open the PDF24 Toolbox (part of PDF24 Creator) and choose "Protect PDF".
  2. Add one or more PDFs.
  3. Enter the "User password", which is the password to open. Leave it empty if anyone may read the PDF.
  4. For permissions, click the gear ("Additional options"): it holds the "Owner password" (password for permissions) and the same seven checkboxes as online. Untick what should not be allowed and set an owner password of its own (why).
  5. Click "Protect PDF files" and save the result.

The button becomes active once a user password is entered or at least one checkbox is unticked. The files never leave your PC.

Protect while creating: PDF printer and output profiles

If you create the PDF with the PDF printer "PDF24" (how it works), you can protect it as you save it:

  1. In the PDF24 Assistant, click "Save as..." and choose the format "PDF" on the left.
  2. Below it, choose the page "Security" and tick "Use security settings". Without this tick nothing on the page is applied.
  3. For a password to open, tick "Password to open PDF required?" and enter the "User password".
  4. For permissions, enter an "Owner password" of its own that differs from the user password (why), and under "Permissions" untick "Print", "Edit", "Restructure", "Copy text and images", "Fill forms" or "Add and change comments".
  5. Leave "Encryption mode" at "256 Bit" (more).
  6. Click "Continue" and choose the folder and file name.

More options on the "Security" page:

  • "Prompt for the password" (below the user password): PDF24 asks for the password to open every time you save. Handy for a profile where every file gets a different password.
  • "Save passwords encrypted?" (on by default): if you save the settings as a profile, PDF24 stores the passwords encrypted for your Windows user account.
  • If a PDF standard such as PDF/A is selected under "General", the page shows a note: the password and permissions are then not applied (more).

Save as a profile: if you need the setting often, create your own profile at the bottom of the window under "Profiles" with "New", or in the Toolbox with "Manage output profiles". Your profile then appears in the profile selection of the Assistant and applies there to "Save as PDF" and "Send by Email". PDF24 Creator offers the same settings when you save.

Right-click in File Explorer and in PDF24 Reader

In Windows File Explorer: select one or more PDFs, right-click them and choose "PDF24" › "Lock PDF" (on Windows 11 in the new context menu or under "Show more options"). The "Security" window opens with "User password", "Owner password", "Encryption depth" and the permissions. For permissions, enter an owner password of its own here as well. After "Ok", PDF24 asks where to save; the name gets the ending _locked, e.g. "contract_locked.pdf". The File Tools window also offers "Lock PDF".

In PDF24 Reader: choose "Save password protected" in the save menu, enter the password to open and choose the file name. The copy is encrypted with AES 256-bit, without further restrictions. If you open a protected PDF in PDF24 Reader and save it with "Save", the protection is kept.

Automatically and from the command line

Protect every print job automatically: create an output profile with security settings and select it as the "Profile" for automatic saving of the PDF printer in the PDF24 settings (saving automatically). If every document needs its own password, the program you print from can write it into the document as a control code (@@su:password@@ for opening, @@so:password@@ for the permissions). To use them, turn on "Recognize control codes in the printed document" for the PDF printer in the PDF24 settings. The control codes are described in the manual.

From the command line without a window: the PDF24 DocTool protects files with -applyProfile and the security values as -profileParam, for example in a batch file:

"C:\Program Files\PDF24\pdf24-DocTool.exe" -applyProfile -profile default/best -profileParam pdf-useSecurity true -profileParam pdf-userPass "open-password" -profileParam pdf-ownerPass "owner-password" -profileParam pdf-allowPrint false -profileParam pdf-allowCopyTextAndImg false -silent -outputFile "C:\Out\contract.pdf" "C:\In\contract.pdf"
  • pdf-useSecurity true turns protection on, pdf-userPass is the password to open, pdf-ownerPass the password for the permissions. For permissions, always give a pdf-ownerPass of its own.
  • Deny permissions with false: pdf-allowPrint, pdf-allowEdit, pdf-allowRestructures, pdf-allowCopyTextAndImg, pdf-allowFillForms, pdf-allowComments, pdf-allowHighQualityPrint (print in low quality only).
  • default/best is the profile "Best quality", which does not downsample images. If you have your own profile with security settings, use -profile user/<name> instead.
  • The PDF is rewritten with the profile, just as when you save in the Assistant. If a finished PDF, such as a form, should only be protected and not changed otherwise, use the Toolbox or Protect PDF instead.
  • While the command runs, the values of -profileParam are visible in the Windows process list. To avoid that, store the passwords in a profile of your own.

-lock, on the other hand, opens the "Security" window and therefore does not work together with -silent. All options are in the manual.

What the permissions do

A tick means allowed. Untick it to forbid the action. Online and in the Toolbox the permissions are called (in brackets the name in the Assistant):

  • "Printing" ("Print"): the PDF cannot be printed.
  • "High quality printing" (not available in the Assistant, "High quality print" when you right-click): if only this one is unticked, printing is allowed, but only in low quality.
  • "Copying of contents" ("Copy text and images"): text and images cannot be selected and copied. Screen readers for blind and partially sighted people always keep access.
  • "Modification of content" ("Edit"): the content must not be changed.
  • "Commenting" ("Add and change comments"): no comments, highlights or notes.
  • "Fill in forms" ("Fill forms"): existing form fields cannot be filled in. This only works if "Commenting" is unticked as well, because under the PDF standard "Commenting" also allows filling in forms. For forms that should be filled in, keep "Fill in forms" ticked.
  • "Assemble document" ("Restructure"): pages must not be inserted, deleted or rotated.

Good to know: permissions are rules for PDF programs. Most programs follow them. PDF24 Reader, for example, then says "The document's permissions do not allow this action". The permissions do not encrypt the content itself, though: whoever can open the PDF can save it without the restrictions using suitable tools. How exactly a restriction is applied also varies from program to program. For confidential content, the password to open is the right protection.

Protect a form from changes

A form you created should stay fillable, but nobody should move or delete fields or change pages? There are two ways:

  • While creating it online: in Make PDF fillable, tick "Protect form from changes" in the "Save PDF" window and set an owner password (typed twice). The form can still be filled in, printed and copied, but fields and pages can no longer be changed. Keep the owner password safe (more on the forms page).
  • For a finished form: in Protect PDF or in the Toolbox, set an owner password and untick "Modification of content", "Commenting" and "Assemble document". Keep "Fill in forms" ticked. Don't set a password to open if everyone should be able to fill in the form.

If a filled-in form should not be changeable at all, flatten it: the entries become fixed content of the page (Save, flatten and send).

Encryption: AES 256-bit

  • Online, in the Toolbox and in PDF24 Reader, PDF24 always encrypts with AES 256-bit. In the Assistant and when you right-click, "256 Bit" is preselected. Every current PDF program opens it.
  • In the Assistant and when you right-click you can choose "128 Bit" instead of "256 Bit" under "Encryption mode" or "Encryption depth", with "Use AES" (AES 128) or without (the older RC4 method). This is only meant for very old PDF programs. "256 bit mode always uses AES", so the checkbox has no effect there.
  • If a password contains characters the 128-bit methods don't know (e.g. Greek or Cyrillic letters, emoji), PDF24 uses AES 256-bit automatically, so that every program reads the password the same way.

How secure a protected PDF is depends mostly on the password: a short or easily guessed password protects little, even with AES 256-bit.

What password protection can and cannot do

What it can do:

  • With a password to open, the content is encrypted. Without the password the file cannot be read, even if it falls into the wrong hands, e.g. through a misaddressed email or a lost USB stick.

What it cannot do:

  • Whoever has the password to open can read the content, copy it out by hand, photograph it or take a screenshot. They can also pass on the file together with the password.
  • Permissions are not copy protection in the strict sense (why).
  • PDF24 has no expiry date, no lock after opening and no tracking of who opened the file.
  • A password does not remove text that should not be in the file. Use redaction for that (remove text).

Send a protected PDF by email

  • Online: below the result of Protect PDF, click "Email" and choose "To me" or "To another person".
  • When printing: in the PDF24 Assistant, choose your profile with security settings and click "Send by Email". The profile also applies to sending, so the attached PDF is protected.

Share the password in a different way from the file, e.g. by phone or text message, not in the same email. Otherwise anyone who can read the email also has the password. If the PDF has to be uploaded to a portal, check first whether it accepts protected PDFs.

PDF/A, signatures, compression: edit first, protect last

Protect a PDF as the last step, once it is finished:

  • Compression and other tools: many editing steps need an unprotected file, and their result is no longer protected. So compress (Compress PDF), merge and edit first, then protect the result.
  • PDF/A: PDF/A does not allow encryption. If you save as PDF/A in the Assistant, PDF24 sets no password (Create PDF/A). If you protect a PDF/A file afterwards, it is no longer a valid PDF/A. If a portal requires PDF/A, send it without a password.
  • Digital signature: if a signed PDF is protected afterwards, the signature becomes invalid (why). In PDF24 Creator you set up both in the same "Save as..." window, on the pages "Security" and "Signature"; PDF24 then protects and signs in one step (sign with a certificate). Always enter an "Owner password" of its own on the "Security" page when you do this, different from the user password.

Forgot the password?

PDF24 cannot recover a forgotten password, and neither can PDF24 support. A PDF encrypted with AES 256-bit cannot be opened without its password. That is exactly what the protection is for.

  • Keep the unprotected original, e.g. on your PC or in your files, and send only the protected copy.
  • Forgot the owner password, or never set one, and want different permissions? Protect the unprotected original again with the settings you want.
  • A new password works the same way: protect the original with the new password. PDF24 online does not protect a PDF that already has a password to open a second time; it then reports that the file is password protected.

Problems and solutions

The PDF opens without a password

  • In the Assistant: is "Use security settings" ticked on the "Security" page? Without it nothing is applied. For a password to open, "Password to open PDF required?" must also be ticked and the "User password" entered. If you also signed the file, an "Owner password" of its own must be entered as well. If PDF/A or PDF/X is selected under "General", no password is set.
  • Online and in the Toolbox: did you only set an owner password? That only protects the permissions; the password to open goes into the field "Password to open the PDF" or "User password".
  • Are you opening the right file? The protected copy is in your download folder or wherever you saved it; the original stays unprotected.

Printing or copying still works although I unticked it

  • If you set a password to open but no owner password of its own in the Toolbox, the Assistant or when you right-click, the password to open also counts for the permissions (PDF24 Creator up to 11.34). Whoever opens the PDF with it may do everything. Protect the original again, with a different owner password (more). Online, PDF24 sets a random owner password in this case, so the permissions do apply there.
  • Some programs ignore permissions or follow them only in part (more).

The PDF asks for a password although "Password to open PDF required?" is off

In the Assistant, a user password that was entered earlier still applies even after the checkbox was unticked. This will be fixed in the next version. Until then: tick "Password to open PDF required?", clear the "User password" field and untick it again; in your own profile, save the profile afterwards.

Online: "The file … is password protected"

The PDF already has a password to open. PDF24 does not protect it a second time. Protect the unprotected original (Forgot the password?).

A portal or program rejects the protected PDF

Some upload portals and archiving systems do not accept protected PDFs, and PDF/A forbids encryption (more). Upload the unprotected original there. A very old PDF program that doesn't know AES 256-bit opens a file protected with "128 Bit" in the Assistant (more).

If you are missing a feature or something doesn't work, write to us at team@pdf24.org or ask in the PDF24 forum.