Protect PDF
Add a password to a PDF, block printing, copying or editing, or both. Encryption runs in your browser with AES-256; the file and the password never leave your device.
How to password-protect a PDF
- Add one or more PDFs. Each row shows the page count and a preview of the first page.
- Choose a password and type it twice. Open Also restrict what others can do to block printing, copying, editing or comments as well — or switch to Restrictions only for a file that opens freely but cannot be printed or copied.
- Click Protect and download the copy. Send the password by a different channel than the file.
Open passwords, restrictions and what viewers actually enforce
PDF security has two layers. The open password (the user password) is the real protection: the whole file is encrypted with a key derived from it, and without the password there is nothing to read. Restrictions are permission flags stored alongside the encryption — no printing, no copying, no editing, no comments — that viewers agree to honour. They are protected by a second, owner password; Toolkitta generates a random one you never see, so the flags cannot be flipped from inside a viewer.
Why restrictions are weaker than they look
A restriction-only file uses an empty open password, so any program can decrypt it and, if it chooses, ignore the flags. That is exactly what Unlock PDF does, and what many desktop tools do. Restrictions are useful for stopping accidental changes or signalling intent — a form that should be filled but not altered, a proof that should not be printed — not for keeping content from someone determined. If confidentiality matters, set an open password.
Compatibility and what changes in the file
Files are encrypted with AES-256 (security handler revision 6), the method specified in ISO 32000-2 and supported since Acrobat 9 (2008), in every current browser's built-in viewer, macOS Preview and the usual phone apps. The document itself is not altered: pages are not copied or flattened, so bookmarks, links, comments, editable form fields and metadata are kept. Before the copy is offered for download, it is reopened with your password to confirm it works. Already-encrypted files are refused — remove the old password with Unlock PDF first — as are digitally signed documents and XFA forms.
Frequently asked questionsUseful details
8 answers +
Is my PDF or my password uploaded?
No. The file is encrypted in your browser with the password you type; neither leaves your device. The password is not stored, not added to the page address and not written into the file in readable form. Keep this tab open until you download the result; reloading clears the session. Website hosting and performance measurement are described in our Privacy notice.
How strong is the protection?
The file is encrypted with AES-256, the strongest method the PDF standard defines and the one Acrobat uses by default. The practical strength is your password: a short or guessable one can be tried at high speed by password-recovery software, a long passphrase cannot. There is no back door, so also keep your unprotected original.
Can I stop people printing or copying without a password?
Yes: choose Restrictions only and tick what to block. The file opens normally, and viewers such as Acrobat, Preview and browsers disable those actions. Understand the limit: such a file is encrypted with an empty password, so a tool like our Unlock PDF, or any PDF library, can produce an unrestricted copy. Restrictions signal intent and prevent accidents; they do not keep content from a determined person.
Which viewers can open the protected file?
Any viewer that supports AES-256 PDF encryption: Adobe Acrobat and Reader 9 or later (2008), the PDF viewers built into Chrome, Edge, Firefox and Safari, macOS Preview, Windows and Android viewers, and iOS. Very old software from before 2008 cannot; there is no option here for the weaker RC4 method those versions used.
What happens to forms, bookmarks and metadata?
They are kept. The document is not copied page by page or flattened; encryption wraps the existing content. Editable form fields stay editable unless you block comments and form filling. The title, author and other metadata are encrypted with the rest of the file, so they are not readable without the password.
Can I protect several PDFs at once?
Yes, up to 20 files, 50 MB each and 200 MB combined, 300 pages per file. The same password and restrictions apply to every file in the run. Download them one by one or as a ZIP. Each copy is reopened with its password before it is offered, so a file that failed that check is reported instead of downloaded.
Which files are not supported?
PDFs that already have a password or restrictions (remove them with Unlock PDF first, then protect with a new password), digitally signed documents (re-saving would invalidate the signature), XFA forms and files over 300 pages. Damaged files are reported; export a fresh copy from the application that made them.
I forgot the password I set. Can you remove it?
No. There is no recovery mechanism and Toolkitta never sees the password, so nobody can restore access. Use the unprotected original you kept, or the source document, and protect a fresh copy. This is the trade-off that makes the protection meaningful.
More help
Guides, common conversions and useful next steps.
Continue with your result
Use the action beside a finished result to send it directly, or open another tool: