How to Password Protect a PDF for Free (2026 Guide)

NIC scans, bank statements, salary slips, medical reports, contracts — most of what people email as a PDF is something they'd rather a stranger not open if it ends up in the wrong inbox. Adding a password takes under a minute and doesn't need Adobe Acrobat or any installed software.

Here's how to actually do it, and what a PDF password does and doesn't protect against.

Add a Password in 3 Steps

1. Open the Protect PDF tool
2. Upload your file and set the password you want to require when opening it
3. Download the protected PDF — the original stays untouched on your device, nothing is kept on the server after processing

That's it. Anyone who opens the file afterward needs the password before they can view a single page.

Open Password vs Permission Password — Know the Difference

PDF protection actually comes in two separate flavors, and mixing them up is the most common mistake people make:

1. Open password (user password): required just to view the file at all. This is what most people mean by "password protect a PDF," and it's what the tool above sets.
2. Permission password (owner password): the file opens without a password, but printing, copying text, or editing is restricted unless you enter it. Useful for things like distributing a form you don't want edited, but it's not real security — most PDF readers let permission restrictions be stripped without much effort.

If your goal is "don't let anyone open this without the password," you want the open password. If your goal is "let people read this but not edit or copy it," that's the permission password, and it's a much weaker guarantee.

What a PDF Password Actually Protects Against

An open password stops casual access — someone who finds the file on a shared drive, a USB stick, or an email attachment that got forwarded to the wrong thread. That covers the vast majority of real situations people are protecting against.

What it doesn't do: stop a determined attacker with password-cracking tools and time on their hands, especially if the password itself is weak (a birthdate, a name, "1234"). PDF encryption strength depends heavily on the password you choose — a short, guessable one gives you the illusion of security more than the real thing. Pick something you wouldn't reuse elsewhere and that isn't tied to public information about you.

Forgot the Password You Just Set?

It happens more than you'd think — you protect a file, close the tab, and can't remember what you typed five minutes later. If that happens and you still know the password (just need to remove it before re-sharing), use Remove Password from PDF. If you've genuinely lost it and have no idea what it was, there's no legitimate way around that — a real open password is designed specifically to make guessing infeasible, which is exactly what you wanted it to do when you set it. Our Unlock PDF guide covers what unlocking is meant for: removing protection you have the right to remove, not bypassing someone else's.

A Practical Workflow for Sensitive Documents

If you're sending something like a scanned CNIC, a signed contract, or a payslip:

1. Merge the front and back scan (or multiple pages) into one file first, if needed — Merge PDF
2. Compress it if the file is large enough to bounce off an email attachment limit — Compress PDF
3. Protect it last, once the file is in its final form — Protect PDF

Doing it in that order matters: compressing or merging a password-protected file usually requires unlocking it again first, so protection should be the last step before you hit send.

Quick Answers

Does this work on phone? Yes — the tool runs in the browser on any device, no app needed.

Will the password protection survive if the recipient re-saves the file? Yes, the encryption is part of the PDF file itself, not something that depends on how it's opened.

Can I set both an open password and a permission password on the same file? That's a more advanced use case than most people need, and isn't something the free tool currently exposes — for now it's built around the open password, which covers the common "don't let anyone view this without a password" need.

Once it's protected, share the file the same way you always do — the password is a separate thing you send through a different channel (text message, in person, a call) so anyone intercepting the email itself still can't get in.