How to Password Protect a PDF (Free, No Acrobat)
Contracts, payslips, medical records, tax forms — the PDFs people most want to password-protect are precisely the ones they least want to hand to a random website. The good news: you don’t need Adobe Acrobat, and you don’t need to upload anything. Here are the free ways to encrypt a PDF on any device, what the settings actually mean, and one honest warning about forgotten passwords.
Option 1: encrypt it in your browser (any device)
The simplest cross-platform route is our Protect PDF with Password tool. Open the page, choose your file, set a password, download the encrypted copy. It applies AES-256 encryption — the current PDF standard — and the whole thing runs in your browser: the file is never uploaded to a server, which matters more for this task than for almost any other. It works the same on Windows, macOS, Linux and Chromebooks, with nothing to install.
Option 2: macOS Preview
Every Mac can do this out of the box. Open the PDF in Preview, then choose File → Export…, tick Encrypt (on newer versions it lives under the Permissions button), enter a password twice, and save. The exported copy requires the password to open. Two caveats: Preview historically used weaker 128-bit encryption on older macOS versions, and it re-writes the file on export, which very occasionally changes how complex PDFs render.
Option 3: Microsoft Word
If the document started life in Word, protect it at export time. Use File → Save As → PDF, click Options…, and tick Encrypt the document with a password. This only helps for documents you author yourself — Word is a poor editor for PDFs someone sent you, since importing them often mangles the layout.
Option 4: Adobe Acrobat (paid)
Acrobat Pro does everything above plus fine-grained permission controls, and it’s the right answer if your organization already pays for it: Tools → Protect → Encrypt with Password. The free Acrobat Reader, confusingly, cannot add passwords — protection is a paid feature. For occasionally locking a file, a subscription is overkill.
Why upload-based converter sites are the wrong tool here
Search “password protect PDF” and the results fill with sites that ask you to upload your file, encrypt it on their server, and give you a download link. Think about what that means: the one document you considered sensitive enough to encrypt has now traveled unencrypted to a stranger’s server, where it may sit in logs, caches or backups you can’t audit — protected only by a privacy policy. For throwaway files that trade-off might be fine; for the payslips and contracts this task is usually about, prefer a tool that does the work on your own machine, whether that’s Preview, Word or an in-browser tool.
User password vs owner password
PDF encryption defines two distinct passwords, and the difference is worth knowing:
| Type | What it does | How strong in practice |
|---|---|---|
| User password (open password) | Required to open and decrypt the file at all | Real protection — the content is encrypted with it |
| Owner password (permissions password) | Restricts printing, copying or editing of an open file | Weak — viewers merely agree to honor the flags, and many don’t |
If you need the document to stay confidential, it’s the user password that counts. Owner-password restrictions (“no printing”) are advisory and trivially stripped by plenty of software, so never rely on them for anything that matters.
What “AES-256” actually buys you
Old PDFs used RC4 encryption at 40 or 128 bits — 40-bit RC4 can be brute-forced in hours on a laptop and should be considered broken. Modern PDFs (PDF 2.0, and PDF 1.7 extensions) use AES-256, the same cipher that protects online banking. With AES-256, the cipher is not the weak point — your password is. An attacker doesn’t break the math; they guess passwords. A short dictionary word falls to automated guessing quickly no matter the algorithm, while a long random passphrase makes the encryption effectively unbreakable. Use twelve or more characters, and share the password over a different channel than the file (text the password, email the PDF).
Forgot the password? A reality check
Properly encrypted means properly encrypted: if you forget the user password of an AES-encrypted PDF, no legitimate tool can recover the contents — that’s the entire point of the design, and any site claiming to “crack” a strong password instantly is selling snake oil. Password managers exist for exactly this reason. If you do know the password and simply want a copy that stops asking for it — say, an e-statement you’ve already unlocked a hundred times — our Remove PDF Password tool decrypts it locally and saves an open copy. Enter password, download, done — again with no upload involved.
Which option should you pick?
On a Mac with a simple need, Preview is right there. Authoring in Word, encrypt at export. Anything else — Windows, Linux, a phone, or a file someone sent you — the in-browser tool gives you AES-256 in three clicks without the file leaving your device. Whatever you choose, the password you pick matters more than the tool that applies it.