Sharing contracts, invoices, or personal documents? A password stops strangers from opening or editing your file. You can password protect a PDF for free online in a few clicks, no software needed. This guide covers the online method plus the options built into Windows, Mac, and common PDF readers.
Method 1: Password protect a PDF online for free
The simplest method works in any browser.
- Open the free protect PDF tool.
- Upload the PDF you want to secure.
- Enter a strong password, aim for at least 12 characters mixing letters, numbers, and symbols.
- Choose what the password guards: opening the document, or permissions like printing and editing. Protecting “open” access is the strongest option.
- Apply the protection and download the secured PDF.
- Test it: close the file, reopen it, and confirm it asks for your password before showing any content.
Method 2: Protect a PDF on Mac with Preview
Preview can add an open password when exporting.
- Open the PDF in Preview.
- Choose File > Export.
- Check the “Encrypt” box.
- Enter your password twice and save.
Method 3: Password protect a PDF on Windows
Windows has no built in PDF password feature, so use the online tool above or a desktop PDF application. Many free PDF readers include a “Protect” or “Security” option under the file or tools menu that sets an open password and permission restrictions. If you handle sensitive documents regularly and do not want them uploaded anywhere, a free offline desktop tool is the safer choice.
Method 4: Protect a PDF on your phone
Open the online protect PDF tool in your mobile browser, upload the file, set the password, and download the protected version. For documents containing bank details or ID scans, consider using an offline app instead so the file never leaves your device.
Choosing a good PDF password
- Use 12 or more characters with a mix of uppercase, lowercase, numbers, and symbols.
- Avoid birthdays, names, and dictionary words, these are the first things automated guessing tries.
- Store the password in a password manager. If you lose it, there is no official way to recover the contents of a strongly encrypted PDF.
- Share the password through a different channel than the file itself, for example, send the PDF by email and the password by text message.
Open password vs. permissions password
PDF security has two layers. An open (user) password is required to view the document at all. This is the real protection. A permissions (owner) password restricts printing, copying, or editing but still lets anyone open the file. Permissions passwords are a polite request rather than a lock: some readers and tools ignore them. If the contents are genuinely sensitive, always set an open password.
Password protection vs. other ways to secure a PDF
A password is the most direct protection, but consider the alternatives. A watermark marks ownership without blocking access, good for drafts. Redaction permanently removes sensitive text rather than hiding it behind a password. And for sharing, sending the file through an encrypted channel or a link that expires can be simpler than managing passwords with every recipient. For documents that must stay readable but controlled, combine a password with a watermark for both security and clear ownership.
Worked example: sending a signed contract to three people safely
Take a job that combines every idea in this guide. You have an 18 page signed contract that must go to a client, their accountant, and your own file. Five of the eighteen pages are an appendix listing bank details and ID numbers; the other thirteen are the agreement itself. The sensitive material is concentrated, so the cleanest plan uses the structure of the document rather than fighting it. Split the file with the split PDF tool into the 13 page agreement and the 5 page appendix. The agreement, which all three recipients need, gets standard handling. The appendix, which only the accountant needs, gets the full treatment: an open password set through the protect PDF tool, sent by email, with the password itself delivered by text message on a separate channel, exactly as the password guidance above recommends.
Now choose the password like it matters, because for a bank details appendix it genuinely does. A passphrase built from several unrelated words plus digits and a symbol clears the 12 character bar in this guide with room to spare and, unlike a string of random characters, can be read accurately over a phone call if the text message never arrives. Store it in your password manager the moment you create it, not in the email thread, not in a note attached to the file, and not in the filename. Then run the test the steps above insist on: close the protected appendix, reopen it, and confirm the password prompt appears before any page does. Test the agreement file too, for the opposite reason. It should open freely, and discovering at this stage that you protected the wrong half is a private embarrassment, while discovering it after sending is a professional one.
The finishing touch is a decision about time. Passwords protect a file wherever it travels, but they do not expire, so a protected appendix sent today is still openable in five years by anyone who kept both the file and the password. For this contract that is acceptable, the parties have an ongoing relationship, but for a one off disclosure, tell the recipient plainly that you will issue an updated document if details change, and keep your own unprotected master in your password managed storage rather than in a mail folder. If a visible mark of ownership would help as well, a light watermark on the appendix pages stating the recipient’s name discourages casual forwarding far better than a password alone, because a forwarded file then names the person it escaped from. Protection, in practice, is layers chosen to fit the document, not the strongest lock applied to everything.
Protection methods compared
Each method in this guide defends against a different threat. Choosing well starts from asking what you are actually worried about:
| Method | Protects against | Does not protect against | Best for |
|---|---|---|---|
| Open password | Anyone opening the file without the password | A legitimate recipient forwarding the file after opening it | Contracts, ID scans, financial documents sent to named people |
| Permissions password only | Casual copying, printing and editing in compliant readers | Determined removal, some tools simply ignore permissions | Drafts and documents you want opened but not casually altered |
| Watermark with recipient name | Unattributed forwarding and leaking | Anyone reading or copying the content itself | Reports and proposals shared with several named recipients |
| Redaction | The sensitive content existing in the shared copy at all | Nothing, removed content is gone from that copy | Documents where some pages or passages must never leave the building |
| Expiring share link | The file lingering in inboxes forever | Copies a recipient downloads during the access window | One off disclosures to people you will not deal with again |
Common mistakes to avoid
- Sending the password in the same email as the file. Whoever gains access to that inbox gains both. Send the file and the password through different channels, every time.
- Protecting the wrong file. It is embarrassingly easy to attach the unprotected version and keep the protected one. Test open the exact file you are about to send.
- Relying on a permissions password for real secrets. Permissions are a request that well behaved readers honour. If the content must not be seen, only an open password, or redaction, actually protects it.
- Choosing a password connected to the document. The contract number, the company name and the signing date are the first guesses anyone tries. A good PDF password has nothing to do with its file.
- Forgetting the password you set. There is no official recovery for a strongly encrypted PDF. Save the password in a password manager at the moment you create it, not from memory later.
- Skipping the reopen test. Protection you have not watched work is a hope, not a lock. Close the file, reopen it, and see the prompt with your own eyes before the file goes anywhere.
Underneath every method here sits one principle worth keeping: encrypt the file, and manage the password like a key, not like a caption. Keys are stored in one trusted place, handed over separately from the thing they open, and changed when they may have been shared too widely. Follow that principle and the mechanics in this guide, a strong open password for genuine secrets, permissions for politeness, watermarks for attribution, redaction when content must simply not travel, become a small set of calm decisions instead of a scramble each time a sensitive document needs to leave your computer. The few extra minutes are the entire cost, and they are spent once, while an unprotected file, once sent, is out of your hands forever.
Protecting a PDF that will be printed
One destination quietly defeats every password in this guide: the printer. An open password guards the file, but the moment an authorised recipient prints the document, the paper copy carries no protection at all. It can be photocopied, photographed and filed anywhere. Think about this before you send, not after. If the content is sensitive enough that a printed copy worries you, the defences move off the file and onto the document itself: a watermark naming the recipient, printed on every page, so any leaked paper copy identifies its source; page numbering that exposes a removed sheet; or simply sending a redacted printing version with the most sensitive figures withheld, keeping the complete file digital only. None of this is a reason to skip the password, the file still needs its lock for its journey through inboxes and cloud folders. It is a reminder that protection has to follow the document through every form it takes, and paper is the form where digital locks stop working and old fashioned attribution takes over.
One password for many files, or a separate password for each?
Sensitive documents rarely travel alone, which raises a question the methods above skip: when a matter involves several files, how many passwords should there be? If the same person needs all of them for the same purpose, the tidiest answer is often one file, not five. Combine the related documents into a single PDF with the merge PDF tool, protect that one file with one strong open password through the protect PDF tool, and share one password through your separate channel. The recipient unlocks everything in one step, and there is exactly one key to store, send and, if necessary, change. The moment the recipients differ, though, the logic reverses: each person’s set gets its own password, because a password reused across unrelated documents means a single leak quietly unlocks every file it was ever attached to. Reuse across recipients is the password equivalent of leaving the same key under every doormat you own. The rule that keeps this simple is worth stating plainly, one audience, one password; a new audience, a new password, and a password manager makes following it effortless, since remembering the passwords was never supposed to be your job in the first place.
Frequently asked questions
Is password protecting a PDF free?
Yes. Online protection tools are free, and built in options like Preview on Mac cost nothing. You do not need paid software to add a password.
How strong is PDF password protection?
Modern PDF encryption with a strong open password is genuinely hard to break. Its strength depends almost entirely on your password: a short or predictable password can be guessed quickly, while a long random one is practically unbreakable with current technology.
What happens if I forget my PDF password?
There is no official recovery, that is the point of encryption. Weak passwords can sometimes be recovered with guessing tools, but a strong password means the file is effectively locked forever. Always keep a copy of the password in a password manager.
Can I remove a password I added myself?
Yes, if you know the password, you can remove it. See our guide on how to unlock a PDF. Removing protection from a file you do not own or are not authorized to open is not something these tools are for.
Is it safe to password protect a PDF online?
For everyday documents it is generally fine with a reputable tool that deletes uploads promptly. For highly sensitive files, legal, medical, financial, use an offline desktop tool so the document never leaves your computer.
Can I password protect only part of a PDF?
PDF password protection applies to the whole file, not individual pages. If only some pages are sensitive, split the PDF and protect just the sensitive part, or redact the sensitive content from the shared version entirely.