How to Protect and Password-Encrypt a PDF in 30 Seconds

Passwords aren't the only protection

When people think of PDF security, they think of passwords. But PDF protection is more nuanced than just "add a password." There are two types of passwords, permission flags, and encryption standards, and understanding the difference actually matters.

Two types of PDF passwords

User password (open password)

This is the password required to open the PDF. Without it, the document is inaccessible. This is the strongest form of protection.

Owner password (permissions password)

This password controls what can be done with the PDF, like printing, copying text, editing, or adding annotations, but it doesn't prevent opening it. Anyone can view the document, but restricted actions require the owner password.

Worth knowing: owner-password restrictions are easily bypassed with many tools. They're a convenience, not a real security measure.

Encryption standards

Modern PDFs support two encryption algorithms:

• AES-128. The standard for most use cases. Strong enough for general document protection.
• AES-256. Military-grade encryption. Use this for highly sensitive documents.

Avoid older PDFs using RC4 or 40-bit encryption. Those standards are broken.

Permission flags

PDFs support granular permissions:

• Print (high resolution / low resolution)
• Copy text and images
• Add or modify annotations
• Fill in form fields
• Edit the document
• Extract content (for accessibility)
• Assemble the document (insert, rotate, delete pages)

Again: these are easily bypassed. Use them for convenience (preventing accidental edits), not for security.

How to protect a PDF

TabTasker's PDF Protect tool lets you:

1. Set a user password (required to open)
2. Set an owner password (controls permissions)
3. Choose encryption strength (AES-128 or AES-256)
4. Set permission flags

The encryption happens locally in your browser. Your PDF never leaves your device.

When to use what

• Highly sensitive documents (tax returns, contracts, medical records): User password + AES-256.
• Internal documents (reports, presentations): User password + AES-128.
• Public documents you want to protect from editing: Owner password with print-allowed, edit-denied permissions (understanding this is a convenience, not security).

Removing protection

If you have the password and need to remove protection, TabTasker's PDF Unlock tool removes passwords and permissions locally.

Bottom line

If a PDF contains sensitive information, encrypt it with a strong user password and AES-256. Permission flags are nice-to-have, not real security. And doing it locally means the encrypted file, and the original, never leave your device.

The password you choose matters as much as the encryption

AES-256 is mathematically unbreakable with current computing power. But the password protecting it doesn't have to be. Encryption is only as strong as the password, because attackers don't try to break AES. They try to guess the password.

A weak password like "document2024" or "password" can be cracked by dictionary attack in seconds, even against AES-256 encryption. A 16-character random password or a four-word passphrase is effectively unguessable.

• Use at least 12 characters, though 16 or more is better.
• Include a mix of uppercase, lowercase, numbers, and symbols.
• Avoid any real word, name, date, or pattern.
• Use a password manager to generate and store it so you don't have to memorise it.

Need a strong password for your PDF? Generate one locally here. It never touches a server. Already have one in mind? Run it through the Password Strength Checker first to see how long it would take to crack.

What to do if you forget the password

With true AES-256 encryption and a strong password, there's no recovery. That's a feature, not a bug: it means no one else can recover it either. But it also means you need to keep the password somewhere safe.

Keep the original unencrypted PDF somewhere secure (an encrypted local folder or password manager attachment) until you are certain you will not need to modify the document and can recover the password. If you need to remove protection later and have the password, TabTasker's PDF Unlock tool handles this locally.

Sharing encrypted PDFs safely

Encrypting the PDF is only half the equation. The other half is transmitting the password to the recipient without exposing it alongside the file. Never send the password in the same email as the encrypted PDF. Use a different channel: a phone call, a text message, or a separate encrypted message. If an attacker intercepts the email containing both the file and the password, the encryption is useless.