How to password protect a PDF
You have a PDF with sensitive content — a tax return, a signed contract, medical records — and you want to add a password before emailing it. Reasonable idea. But PDF password protection is one of those things that sounds more secure than it actually is, and understanding what it does and does not do will help you make a better decision about how to protect your files.
Two types of PDF passwords
The PDF format supports two distinct password types, and they do very different things.
User password (open password): Prevents anyone from opening the PDF without entering the password. The file contents are encrypted. Without the password, the document is unreadable. This is the useful one.
Owner password (permissions password): Sets restrictions like "no printing," "no copying text," or "no editing." The file can still be opened and read without a password — the restrictions only apply if the PDF viewer chooses to respect them. Many viewers ignore these restrictions entirely. The owner password is a polite request, not a lock.
When people say they want to "password protect" a PDF, they almost always mean the user password. That is what the methods below will set.
Method 1: Microsoft Word (Windows and Mac)
If you are creating the PDF from a Word document, you can set a password during the export. Go to File, Export, Create PDF. On Windows, click Options and check "Encrypt the document with a password." On Mac, the workflow is similar through the Save As dialog with the PDF format selected.
This sets a user password that encrypts the PDF. Anyone who receives the file must enter the password to open it. The encryption uses AES-128 or AES-256, which is strong enough for any practical purpose.
Method 2: macOS Preview
On a Mac, open the PDF in Preview. Go to File, Export. Check the "Encrypt" checkbox at the bottom of the dialog. Enter a password. Save. The resulting PDF requires the password to open.
This is the fastest method on macOS and requires no additional software. The encryption is handled by the operating system's built-in PDF engine.
Method 3: LibreOffice (Windows, Mac, Linux)
LibreOffice is free and runs on every platform. Open a document (or import a PDF via LibreOffice Draw), then go to File, Export as PDF. In the export dialog, switch to the Security tab. Set an open password. Click Export.
LibreOffice's PDF export supports both user and owner passwords, and you can choose the encryption level. For most purposes, the defaults are fine.
Method 4: Online tools
Several online services will add a password to your PDF. You upload the file, set a password, and download the protected version. Smallpdf, ILovePDF, and Adobe's online tools all offer this.
The obvious concern: you are uploading a sensitive document to someone else's server in order to protect it. The irony is not lost. If the document is sensitive enough to need a password, it is sensitive enough to not upload to a third-party service. Use one of the local methods above instead.
What PDF passwords actually protect
A user password with AES-256 encryption is genuinely strong. Without the password, the file cannot be read. The encryption is solid and there is no practical way to break it with a strong password.
But there are limits that the format itself cannot solve:
- You still have to share the password. If you email the PDF and the password in the same email, anyone who intercepts the email has both. Send the password through a different channel — a text message, a phone call, a separate messaging app.
- Once opened, the content is unprotected. The recipient can print the document, take screenshots, or save a copy without the password. The password controls access, not distribution.
- Weak passwords are easy to crack. PDF password crackers exist and work quickly against short or common passwords. Use something at least 12 characters long with mixed character types.
- Metadata may not be encrypted. Depending on the tool used to create the protected PDF, the title, author, and other metadata fields might still be readable without the password. If the document title itself is sensitive, check this.
When a password is not enough
For truly sensitive documents — legal discovery, medical records, financial data subject to compliance requirements — a PDF password is a basic precaution, not a complete solution. Consider whether you also need to strip metadata before sending, use an encrypted file-sharing service instead of email, or consult your organisation's data handling policies.
For everyday use — sending a tax form to your accountant, sharing a contract draft with a client — a strong user password sent through a separate channel is a reasonable level of protection that takes thirty seconds to set up.