How to Password Protect a PDF for Free

Sending a PDF with sensitive information — a contract, a financial statement, personal identification — without password protection is a security risk. Here’s how to add password protection to any PDF for free.

---

Types of PDF Password Protection

PDFs support two types of passwords:

1. User/Open password: Required to open and view the PDF. Without this password, the document can’t be read at all.

2. Owner/Permissions password: Controls what users can do with the PDF even after opening it — whether they can print, copy text, or make changes. Without an owner password, all permissions are enabled.

For most use cases, you only need a user password (to protect the content from unauthorized readers).

---

PDF Encryption Levels

Encryption	Security	Use Case
40-bit RC4	Weak (avoid)	Legacy compatibility only
128-bit RC4	Moderate	Older Acrobat compatibility
128-bit AES	Good	Standard choice
256-bit AES	Excellent	Highly sensitive documents

Always use 128-bit AES minimum. 256-bit AES is recommended for sensitive documents.

---

Method 1: AltoUnlockPDF Password Tool (Free)

Our PDF Password tool:

1. Upload your PDF
2. Enter and confirm a password
3. Choose encryption level (we default to 256-bit AES)
4. Click Protect → Download the encrypted PDF

---

Method 2: LibreOffice (Free Desktop App)

LibreOffice can export any file as a password-protected PDF:

1. Open the document or PDF in LibreOffice
2. File → Export as → Export as PDF
3. In the PDF Export dialog, click the Security tab
4. Set “Open file” password
5. Optionally set permissions restrictions
6. Click Export

This works for any file format LibreOffice can open (Word, Excel, etc.) — not just existing PDFs.

---

Method 3: Ghostscript (Command Line)

# Add user password (to open)
gs -dNOPAUSE -dBATCH -sDEVICE=pdfwrite \
   -dEncryptionR=3 \
   -dKeyLength=128 \
   -sUserPassword=MySecretPassword123 \
   -dOwnerPassword=OwnerPassword456 \
   -sOutputFile=protected.pdf input.pdf

# 256-bit AES encryption (Acrobat 9+ required to open)
gs -dNOPAUSE -dBATCH -sDEVICE=pdfwrite \
   -dEncryptionR=6 \
   -dKeyLength=256 \
   -sUserPassword=StrongPassword \
   -sOutputFile=protected.pdf input.pdf

---

Method 4: Python — pikepdf

import pikepdf

def protect_pdf(input_path, output_path, user_password, owner_password=None):
    """Add password protection to a PDF."""
    if owner_password is None:
        owner_password = user_password
    
    with pikepdf.open(input_path) as pdf:
        no_print = pikepdf.models.Encryption(
            user=user_password,
            owner=owner_password,
            allow=pikepdf.models.AllowedOperations(
                printing=pikepdf.models.PrintingOptions.none,  # Disable printing
                extract_text=False,                             # Disable text extraction
                modify=False,                                   # Disable modification
            )
        )
        pdf.save(output_path, encryption=no_print)
    
    print(f"Protected PDF saved to {output_path}")

# Simple protection (just open password)
with pikepdf.open('sensitive.pdf') as pdf:
    pdf.save('protected.pdf', encryption=pikepdf.Encryption(user='MyPassword', owner='OwnerPwd'))

---

Method 5: Mac Preview (Simple User Password)

1. Open the PDF in Preview
2. File → Export as PDF
3. Check Encrypt checkbox
4. Enter and verify a password
5. Click Save

---

Choosing a Strong PDF Password

Password-protected PDFs can be brute-forced if the password is weak. Guidelines:

• Minimum 12 characters
• Mix of: uppercase, lowercase, numbers, symbols
• Avoid: dictionary words, birth dates, names
• Use a passphrase: “correct-horse-battery-staple” is much harder to crack than “P@ssw0rd”

For highly sensitive documents, a 20+ character random password stored in a password manager (like Bitwarden or 1Password) is best practice.

---

Limitations of PDF Password Protection

PDF passwords are not invulnerable:

• Weak passwords can be cracked with tools like Hashcat
• Owner/permissions passwords are relatively easy to bypass
• If someone has the password, they can remove protection

For truly sensitive documents, consider:

• Full disk encryption (BitLocker, FileVault) for local storage
• Encrypted email (ProtonMail, PGP) for transmission
• Enterprise DRM solutions for business documents

PDF passwords are effective as a “reasonable barrier” against casual unauthorized access — not as a bulletproof security solution. According to NIST guidelines, 256-bit AES encryption is classified as “top secret” strength — the math is sound; the weak link is always human-chosen passwords.