How to password-protect a PDF before sharing it
By the Converterzilla Team
We build privacy-first PDF and image tools that run entirely in your browser. Our team has shipped JavaScript file-processing apps used by thousands every day, and we write here about the libraries, trade-offs and patterns we use.
Sending a PDF with sensitive content — a contract, a financial report, an invoice with bank details — without a password is leaving the door unlocked. PDF encryption is built into the format spec; modern AES-256 is uncrackable in any practical sense. The mistakes happen at the password level, not the encryption level.
User vs Owner password
PDFs support two passwords:
- User password — required to open the file at all
- Owner password — required to change permissions (printing, copying, editing)
For a confidential document, set both. The user password gates access; the owner password prevents recipients from removing the restrictions you set.
Permission flags worth knowing
- Allow printing — useful for reports the recipient needs to print
- Allow content copying — disable for legal docs to prevent quote-and-share
- Allow modifications — disable to lock the document's content
- Allow form filling — keep enabled if it's a form, otherwise disable
The password itself
AES-256 makes brute-force impractical, but only if your password is decent. A 6-character word from the dictionary cracks in seconds. A 14-character random string takes effectively forever. Use a password manager and set something long.
How to share the password
Don't email it with the file. Send the file in one channel (email) and the password in another (text, voice, signal). This is basic but critical.
Our Protect PDF tool will use AES-256 with both password levels and full permission control.