How to Password-Protect a PDF (and When Not To)

A password on a PDF means that anyone who gets the file, whether from a forwarded email, a shared folder or a lost USB stick, can't open it without the password. It's a sensible step for tax returns, payslips, medical records and contracts you send by email. It's also something you should not do for many official uploads, which reject protected files.

This guide shows you how to protect a PDF properly, how to share the password, and when to leave the file unprotected.

Two kinds of PDF password

• Open password (user password): the file can't be opened at all without it. This is what protects your data.
• Permissions (owner restrictions): the file opens, but actions such as printing, copying text or editing are restricted. These restrictions are useful as instructions, but they aren't a strong barrier on their own.

How to protect a PDF

1. Open Protect PDF and add your file.
2. Type an open password, then type it again to confirm.
3. Optionally set permissions: allow or block printing, copying text, modifying, and filling in forms or commenting.
4. Download the protected PDF.

The file is encrypted with AES-256. If you restrict permissions, a random owner password is generated for you, so nobody can simply lift the restrictions with your open password. Everything runs in your browser, so the file and the password stay on your device.

Important: if you forget the password, it can't be recovered, not by us or anyone else. Save it in your password manager before you send the file.

Choosing a password that actually protects

AES-256 is strong encryption, but a weak password undoes it. Someone who has the file can try guesses as often as they like.

• Use a long passphrase, such as four or five unrelated words, instead of a short "clever" password.
• Don't use obvious details: the recipient's date of birth, the last four digits of their SSN, or your company name plus the year.
• Use a different password for each recipient when the content is different.

Share the password on a different channel

Emailing the password in the same message as the file defeats the purpose. Better options:

• Send the file by email and the password by text message or phone call.
• Agree on the password in person for documents you send regularly.
• Use a password manager's sharing feature if both of you use one.

When NOT to password-protect

Many official portals reject protected or encrypted files, because staff and systems have to open them without a password. Examples from official pages we checked in September 2026:

• USCIS online filing: "Do not encrypt or password protect your files."
• Australia's ImmiAccount: encrypted or secured PDFs aren't accepted.
• New York's NYSCEF: documents should not be password-protected or encrypted.

If you're uploading to a government portal, a court or an application system, assume no password unless it explicitly asks for one. The portal's own security (your login, HTTPS) protects the file in transit.

Removing a password you set

If you need to upload a file you protected earlier, or a bank sends statements with a password, Unlock PDF removes the protection. You type the password once, and it removes the password along with owner restrictions. It doesn't guess or crack passwords, and it's only meant for documents you have the right to unlock.

A password doesn't replace redaction

Protection controls who can open the file. Once someone opens it, they see everything. If the recipient shouldn't see certain details at all, such as an account number or another person's information, remove them first with Redact PDF. It turns the marked pages into images with the areas painted solid black, so the hidden text is truly removed. Then add a password if you still need one.

Which permissions to choose

If you set permissions, think about what the recipient actually needs to do:

• Accountant or lawyer reviewing your documents: allow printing and copying, because they may need to quote figures. The open password does the protecting.
• A finished contract sent for reference: block modifying, and allow printing so it can be filed on paper.
• A form someone must complete: allow filling in forms, and block other changes.
• Material you don't want reused: block copying text, but remember this is a restriction, not a lock. Anyone who can open the file can still read it and take screenshots.

When in doubt, leave permissions open and rely on a strong open password. Extra restrictions mostly annoy legitimate recipients.

Test before you send

Open the protected file on your own device before sending it. Check that it asks for the password, that the password you saved works, and that the permissions behave as you expected (for example, that printing is blocked if you blocked it). A two-minute test avoids an awkward "I can't open your file" reply, or worse, a file that was never actually protected.

Common mistakes

• Password in the same email as the attachment.
• Weak, guessable passwords based on personal details.
• Relying on "no copying" alone for sensitive data. Use an open password for real confidentiality.
• Protecting files for portals that require unprotected uploads.
• Losing the password. There's no recovery, so keep a record.

Checklist

• Open password set, long and unique.
• Permissions only if you need them.
• Password saved in a manager and shared on another channel.
• No password for official uploads that forbid it.
• Sensitive details redacted, not just hidden behind the password.