How to password-protect a PDF
- Write the password down first
There is no recovery. None. A forgotten password means a permanently unreadable file.
- Choose the permissions
Printing only is a sensible default for a document you are circulating.
- Encrypt
The result is a new file; the original is unchanged.
- Send the password separately
Emailing an encrypted file and its password in the same message achieves nothing at all.
Why this matters for exam and study documents
Study group notes shared in a chat are one forward away from being public. Encrypting the file and sending the password by another route takes a minute and keeps a private document private.
What is kept, what changes, and what this will not do
The difference between what a tool prevents and what it merely requests matters more here than anywhere else on the site, so each one states which it is.
Kept
- All content, exactly
- Page count, order and the text layer
Changed
- The file requires a password to open
- Permission flags are set
- Some older readers may refuse AES-256 files
Limits
- The password cannot be recovered. Nothing here stores it.
- Permission flags are honoured voluntarily by readers; they are not enforcement.
Questions and answers
Can you recover my password if I forget it?
No. Nothing here records it - it exists in memory for the duration of the operation and is gone when the response is sent. AES-256 with a decent password is not breakable by any means available to anyone. Write it down.
What is the difference between encryption and permissions?
Encryption makes the contents unreadable without the key: that is cryptography, and it holds. Permissions are flags saying what a reader should allow after decryption, and a reader is free to ignore them. Treat permissions as a courtesy and encryption as the actual protection.
Will everyone be able to open my protected PDF?
Any reader from the last decade handles AES-256. Some very old software and a few embedded readers do not.
Is the password sent over the internet?
It is submitted with the form over HTTPS, used for that one operation, and never written to disk or logged. If that is not acceptable for your threat model, encrypt on your own machine instead - that is a reasonable position and we would rather say so than talk you out of it.