PaperKitPaperKit › Protect PDF
Protect PDF
Password-protect a PDF in your browser with AES-256 encryption. Set an open password, a permissions password, and block printing or copying. Free, no upload.
How to use Protect PDF
- Drop a PDF file.
- Type the password to open it and choose what readers may do.
- Download the encrypted copy and keep the password safe.
How to password-protect a PDF without uploading it
Sending a confidential PDF through an online protection service means handing the unprotected document to a stranger first. PaperKit encrypts the file in your browser instead: the password is turned into keys locally, every string and stream in the document is encrypted with AES-256, and the result downloads as paperkit-protected.pdf. The format is the standard PDF security handler, revision 6, so the file opens in Adobe Acrobat and Reader, Apple Preview, Chrome, Firefox, Edge and every modern viewer that asks for a password.
Open password and permissions password
The open password (the PDF standard calls it the user password) is what anyone must type to see the document. The permissions password (owner password) unlocks the restrictions and lets someone remove the protection. If you leave the permissions password empty, PaperKit uses the open password for both, which is what most people want. If you leave the open password empty but set a permissions password, the PDF opens freely but readers cannot print, copy or edit unless they know the permissions password.
- Open password only: everyone needs it, and it also lifts restrictions
- Both passwords: readers open with one, you control changes with the other
- Permissions password only: opens freely, restrictions enforced by readers
What the permission presets block
Everything leaves the permission bits open. No printing clears printing and high-quality printing. No copying clears text and image extraction while keeping extraction for screen readers. Read only blocks printing, copying, editing, commenting, form filling and page assembly. These flags are honoured by well-behaved readers; a determined person with the open password can still screenshot the pages, so treat the open password as the real protection.
How strong is it
PaperKit writes AES-256 with the hardened SHA-2 key derivation of revision 6, the strongest encryption the PDF standard defines. A password of eight random words or a long passphrase cannot be brute-forced in practice; a short dictionary word can, so pick something long. The encryption key itself is 32 random bytes generated by your browser, and the password is never written into the file.
Where the work happens
The document is parsed with pdf-lib in your tab, the key schedule runs with WebCrypto, and the encrypted copy is assembled locally. Nothing is uploaded, nothing is logged, and your original file stays untouched on disk. If you lose the password there is no recovery: PaperKit cannot open the file for you either.
Already protected, forms and signatures
A PDF that is already encrypted must be unlocked first, then protected again with the new password; PaperKit says so instead of double-encrypting. Form fields, bookmarks, links and metadata are preserved. Digital signatures are preserved as bytes but will usually show as invalid afterwards, because encrypting changes the file; sign after protecting, not before.
Checking the result
Open paperkit-protected.pdf in Preview, Acrobat or the PaperKit PDF Viewer: it asks for the password. Unlock PDF reads the encryption details back and can remove the protection again with either password. Compress the file before protecting it if size matters; encrypted streams cannot be recompressed afterwards.
Next steps
- Remove a password you know
- Open the protected file to check it
- Strip author and title before sharing
- Compress first, then protect
Related PDF tools
- Unlock PDF — Remove the password and the printing or copying restrictions from a PDF whose password you know, locally in your browser.
- Remove PDF Metadata — Strip author, title, producer, and keyword metadata from a PDF to protect privacy.
- Compress PDF — Shrink a PDF by re-encoding the photos and scans inside it at the quality you choose, or fit it under 100 KB, 500 KB or 1 MB, all in your browser.
Frequently asked questions
How do I password-protect a PDF for free?
Drop the file on PaperKit Protect PDF, type the password people will use to open it, pick what readers may do, and download paperkit-protected.pdf. The encryption runs in your browser; nothing is uploaded.
Which encryption does it use?
AES-256 with the PDF standard security handler revision 6, the same scheme Acrobat uses for its strongest setting. Every PDF reader released since 2010 opens it.
What is the difference between the open password and the permissions password?
The open password is required to view the PDF. The permissions password lets someone lift the printing or copying restrictions and remove the protection. If you set only one, it is used for both.
Can I stop people from printing or copying?
Yes, with the No printing, No copying or Read only presets. Readers such as Acrobat and Preview enforce them; they are not unbreakable, so use an open password for anything confidential.
What if I forget the password?
The file cannot be opened. PaperKit does not keep passwords or keys, so there is nothing to recover. Keep the original unprotected copy somewhere safe.