How to Password Protect and Unlock a PDF (and What It Really Stops)

To password protect a PDF, upload it to a tool that applies encryption, choose a strong password, set what recipients may do (print, copy, edit), and download the new file. To unlock one, you need the existing password: you enter it, and the tool saves a copy without the lock. You can do both with FileCrank's Protect PDF and Unlock PDF tools, free and without an account.

That is the quick version. The part most guides skip is what a PDF password actually protects you from, and what it does not. This article covers both, along with how to share the password without undoing all your effort.

User passwords vs owner passwords

PDF has two distinct kinds of password, and mixing them up leads to false confidence.

A user password is real access control. Without it, the contents are unreadable ciphertext.

An owner password is different. A file can open for anyone with no password at all and still carry permission flags such as "do not print" or "do not copy text". Those flags are instructions that PDF software chooses to respect. Software that ignores them can, and freely available tools do. Treat an owner password as a way to discourage casual misuse, not as security.

FileCrank's Protect PDF tool takes a single password, which becomes the open (user) password. For each file it also generates a random owner password that is never stored or shown, so a compliant PDF reader that opens the file with your password applies the permissions you ticked. By default printing is allowed and copying text and editing are not. Those permissions are still enforced by the reader rather than by the encryption, so software that ignores them can bypass them, and anyone you give the password to can open the file.

How PDF encryption works (the short version)

When you protect a PDF, the tool derives an encryption key from your password and uses it to scramble the content. Opening the file reverses the process.

Two things decide how strong the result is: the algorithm and key length, and the password.

Algorithms you will see

• RC4 (40-bit and 128-bit): older and no longer considered strong. 40-bit is trivially breakable by modern computers. You will mostly meet it in legacy files.
• AES-128: a modern, well-vetted cipher with a 128-bit key. Widely supported.
• AES-256: the same cipher with a 256-bit key. It is the standard in current PDF versions and the best option for sensitive documents, though some very old readers cannot open it.

The key size rarely decides the outcome. Brute-forcing a properly implemented 128-bit key is not realistic. What attackers actually do is guess the password. If your password is 1234 or your dog's name, the encryption underneath hardly matters, because it takes moments to try the likely candidates.

What this means for the password you choose

• Use 12 or more characters. A random passphrase of several unrelated words is easy to remember and hard to guess.
• Do not reuse a password from your email, banking or any other account.
• Avoid names, birthdays and anything findable on your social media.
• Generate it in a password manager when you can.

FileCrank's tool accepts passwords of 4 to 127 printable ASCII characters, and a password cannot start with a hyphen (-). Four characters is the technical minimum, not a recommendation. If the document matters, use something far longer.

A note on the cipher itself: FileCrank's Protect PDF tool applies AES-256 encryption (PDF revision 6) using qpdf, and the result opens in current PDF readers. Very old PDF software that predates AES-256 support may not be able to open it. The encryption is only as strong as your password, and the print, copy and edit permissions are enforced by the reader, not the cipher. If you need to meet a specific compliance requirement, check what it requires and verify the result in a PDF reader's document properties.

What PDF password protection does not stop

Being honest about limits is the most useful part of any security advice.

A password does keep casual viewers out. If you send a contract to the wrong email address, a user password means the stranger cannot read it without the password. That alone justifies using one.

It does not:

• Stop the recipient from sharing the contents. Once someone opens the file, they can screenshot it, photograph the screen, retype it, or forward the unlocked version.
• Enforce restrictions reliably. "No copying" and "no printing" flags depend on software cooperation.
• Protect against a weak password. Guessable passwords fall quickly.
• Hide the file's existence. The name and size remain visible, and in some cases other details too.
• Protect you if the password travels with the file. A password in the same email is as good as no password.
• Replace access control or e-signature systems. If you need audit trails, expiry or revocation, use a document management system.
• Recover itself. If you lose the password, the content is gone. FileCrank does not keep passwords and cannot reset them.

Think of a PDF password as a lock on an envelope. It is useful, and it makes accidents less costly, but it is not a vault.

How to password protect a PDF step by step

Before you begin, decide who the recipient is, whether they need to print or copy, and how you will pass them the password.

1. Open the Protect PDF tool and upload your file. The tool page states the current size limit.
2. Enter a strong password and confirm it. Use a passphrase or a password-manager-generated string.
3. Choose permissions. Leave printing on if the recipient will need a paper copy. Leave copying and editing off if you want to discourage them.
4. Process the file and download the protected copy.
5. Test it. Open the result in another PDF reader or browser, confirm it asks for the password, and check that it opens with the password you set.
6. Store the password in a password manager, separately from the file.
7. Keep the original. If you will need to edit the document later, the unprotected source saves you from having to unlock it.

A privacy note on using online tools

Protect PDF and Unlock PDF process your file on FileCrank's servers: the PDF and the password are sent over HTTPS, used for the operation, and the files are deleted automatically after about an hour. The password is not stored. That is acceptable for most everyday documents. If the file is extremely sensitive, such as legal discovery material or medical records covered by strict rules, consider a desktop application so the file never leaves your machine. For more on the trade-offs between browser-based and server-based processing, read why browser-based file tools are safer.

How to unlock a PDF you have the right to open

Unlocking means removing the password so the file opens freely. Typical legitimate reasons:

• You protected your own document and no longer need the lock.
• A colleague or client gave you the password and you want an unlocked working copy.
• An old archive of your own files has a lock you no longer want on it.
• You want to edit, merge, or compress a file whose owner restrictions block those operations, and you are entitled to do so.

Steps

1. Open the Unlock PDF tool and upload the locked file.
2. Enter the current password. This is the password you were given or set.
3. Process and download the unlocked copy.
4. Check the result by opening it without a password prompt.

The tool supports the common PDF encryption types, including RC4 and AES. It also removes the permission restrictions in the saved copy, so editing, printing and copying become available. Your original file is untouched.

If you enter the wrong password, you get an error rather than a broken file. Check for typos, Caps Lock and whether you are using the open password or the owner password, then try again.

What this tool will not do

FileCrank's Unlock PDF requires the correct password. It does not guess, crack or bypass passwords, and we will not give instructions for breaking into files that belong to someone else. If you do not have the password and the file is yours, these are the legitimate routes:

• Search your password manager, notes and email for it.
• Ask the person who sent the file.
• Look for an earlier version of the document that was not protected.
• Contact the organisation that issued it. Banks, utilities and payroll providers often use a predictable pattern, usually described in the accompanying email or on their site.
• Recreate the document from its source if you have it.

Respect the owner's intent. A restricted PDF someone else sent you was restricted for a reason, and removing that lock without permission can breach terms of use or the law in some countries.

Sharing PDF passwords safely

A strong lock does nothing if the key is posted next to it.

• Use a different channel. Email the file, then send the password by phone call, a secure messaging app, or a text. Never put both in the same message.
• Prefer a password manager's sharing feature for teams and recurring recipients.
• Do not hint in the filename or subject line. "Invoice_pw_2024.pdf" gives it away.
• Set a fresh password per document or per recipient for anything confidential, so one leak does not expose everything.
• Tell the recipient what to do next. Ask them to confirm they opened it, and delete the message with the password once it is no longer needed.
• Avoid passwords that you would be embarrassed to see leaked. If it is a personal phrase, it will be reused somewhere.
• For long-lived sharing, consider a link-based system with expiry instead of an attachment, since you can revoke a link but not a file that has already been delivered.

Quick checklist

Before sending a protected PDF:

• Password is 12+ characters and not reused
• Permissions match what the recipient needs
• File tested in a second reader
• Password goes by a separate channel
• Password saved in a password manager
• Unprotected original kept safely
• You are comfortable with the recipient sharing the contents, because a password cannot prevent that

Conclusion

A PDF password is a sensible, low-effort layer of protection: it stops accidental exposure and discourages casual copying, as long as the password is strong and delivered separately. It is not a substitute for trust, or for access controls when the stakes are high. Know which kind of password you are setting, pick a long one, and keep an unprotected original.

Ready to try it? Protect a PDF with a password, or unlock a PDF you own. Neither needs an account.