Protect PDF With Password Encryption Online
Add password protection to your PDF document online for free. Encrypt PDF with user and owner passwords to secure sensitive content.
Drop file here or browse
Maximum file size: 50 MB
Protecting a PDF with a password prevents unauthorized access to sensitive documents such as contracts, medical records, financial statements, or any confidential content. CocoPDF encrypts your PDF with AES-256 encryption, creating a password-protected file that only the person with the correct password can open.
The protection goes beyond just a password prompt. The tool sets a user password (required to open the file) and an owner password (required to change permissions). Editing, high-resolution printing, and text copying are disabled, which makes the protected PDF view-only for users who know the password.
Enter your desired password and click Process. The protected PDF downloads immediately. We never store your password. It is used server-side to encrypt the file and is immediately discarded. The output file is deleted within one hour and no watermarks are added.
Encryption is genuine here rather than cosmetic. The contents are mathematically scrambled with AES-256, and without the correct password the bytes are unreadable, which is why protection cannot be sidestepped by renaming the file or opening it in a different viewer. The algorithm is not the weak point in any realistic scenario. The password is, because an attacker guesses passwords rather than attacking the cipher.
That makes password choice the whole game. Length beats complexity, so a long passphrase is stronger than a short string of symbols, and anything derived from the document itself is a poor choice, since a payslip protected with the employee number is guessable by exactly the people most likely to hold the file. Whatever you choose, store it somewhere safe first, because a lost PDF password genuinely cannot be recovered by anyone.
Delivery is where real-world protection most often falls apart. Sending the encrypted file and its password in the same email, or in a follow-up to the same address, means anyone with access to that mailbox has both and the encryption has achieved nothing. Use a separate channel: a phone call, a text message, or a password manager share. It is also worth applying protection last, after any merging or compression, since those operations need the file unlocked.
What the encryption actually does
AES-256 scrambles the contents mathematically, so without the correct password the bytes are meaningless. This is real encryption rather than a flag that software agrees to respect, which is why it cannot be sidestepped by renaming the file, opening it in a different viewer, or running it through a converter.
Two passwords are set. The user password is required to open the document at all. The owner password governs permissions, and with it in place editing, text copying, and high resolution printing are disabled, while form filling and low resolution printing remain available. Recipients who know the password get a document they can read and use without being able to take it apart.
The cipher is not the weak point in any realistic scenario. Nobody attacks AES-256; they guess passwords. That is the entire reason the next section matters more than this one.
Choosing and handling the password
Length beats complexity. A long passphrase of ordinary words is harder to guess than a short string of substituted symbols and considerably easier to communicate over the phone, which you will end up doing. Four or five unrelated words is a genuinely strong choice.
Never derive it from the document. A payslip protected with the employee number, an invoice protected with the invoice number, or a client file protected with the client name is guessable by precisely the people most likely to be holding the file. The same applies to a date of birth on anything personal.
Write it down somewhere durable before you close the tab. We never store passwords, so a forgotten one cannot be recovered by us or by anyone else, and the encrypted document is then permanently unreadable. A password manager entry takes ten seconds and is the difference between a protected file and a lost one.
Getting the file and the password to the recipient
This is where protection most often fails in practice, and it has nothing to do with the cryptography. Emailing the encrypted file and then emailing the password to the same address means anyone with access to that mailbox has both, and the encryption has accomplished exactly nothing. A compromised inbox is the threat most of these documents are protected against in the first place.
Use a different channel for the password. A phone call, a text message, a chat on a different platform, or a password manager share all work, because they require an attacker to have compromised two things instead of one. Agreeing a password in advance for a recurring exchange works even better, since it never travels at all.
Apply protection last in your workflow. Merging, splitting, compressing, and almost everything else needs to read the document structure, which encryption exists to prevent, so a file protected too early has to be unlocked again before you can finish working on it. Compress first, protect second.
How to Protect PDF Online in 3 Simple Steps
- 1
Upload your file
Drag and drop your file onto the upload box, or click to browse. CocoPDF accepts a file up to 50 MB each.
- 2
Adjust the settings
Choose the options you need for Protect PDF. The default settings work well for most documents.
- 3
Download the PDF file
Click the process button. The file is generated on our server and your PDF download starts automatically.
Frequently Asked Questions
What type of encryption is used?
CocoPDF uses AES-256 encryption (PDF 1.7 standard). This is the strongest encryption supported by the PDF format and is resistant to brute-force attacks with a strong password.
What permissions are restricted on protected PDFs?
Protected PDFs allow opening and reading with the correct password. Editing, copying text, and printing at high resolution are restricted. Filling forms and low-resolution printing are allowed.
What happens if I forget the password?
We do not store passwords. They are never sent to our servers in a recoverable form, so we cannot recover a lost password for you. The Unlock PDF tool removes protection once you know the password, but it cannot bypass one you have genuinely forgotten. Store new passwords somewhere safe before you close the tab.
Can I protect a PDF that is already password-protected?
The tool requires the input PDF to be unprotected (or you must unlock it first). Then you can add a new password.
How should I send the password to the recipient?
Through a different channel from the file. Emailing a protected PDF and its password in the same message, or in a follow-up to the same address, means anyone with access to that mailbox has both. A phone call, a text message, or a password manager share keeps them separate.
Does protection stop someone copying the content another way?
No. Encryption controls who can open the document, not what a legitimate reader does next. Someone with the password can still read the screen, photograph it, or retype the contents. It prevents unauthorised access, not onward sharing by a trusted reader.
Can I still merge or compress a protected PDF?
Not while it is encrypted, since those operations need to read the document structure. Remove the password with the Unlock PDF tool, do the work, then apply protection again to the finished file. This is worth remembering before you protect something you still need to edit.
What makes a good PDF password?
Length matters more than complexity, so a long passphrase beats a short string of symbols. Avoid anything derived from the document itself, since a payslip protected with the employee number is guessable by exactly the people most likely to have the file. Store it somewhere safe, because it cannot be recovered.
Will the protected file open on a phone?
Yes. AES-256 is part of the PDF standard, so any current reader on any platform will prompt for the password and open the document. Very old readers predating the standard are the only exception and are rare enough not to plan around.
Does encrypting change the document content or size?
The content is untouched, and the file grows only marginally. Pages, text, images, and form fields are all preserved exactly. Encrypted data does not compress well though, which is why compression has to happen before protection rather than after.
Can I use the same password for a batch of documents?
You can, and for a set of files going to the same person it is reasonable. For files going to different people it is a poor idea, because one leaked password exposes the whole set rather than a single document.
Is protection the right tool for a document I only want people to read?
Partly. It stops anyone without the password from opening the file and restricts editing and copying for those who do. It cannot stop a legitimate reader photographing the screen or retyping the text, so treat it as access control rather than as a way to prevent onward sharing.
In-Depth Guide
PDF Password Protection: What It Actually Does →Password-protecting a PDF encrypts its contents. We explain the difference between user passwords and owner passwords.