Task
Password-protect a PDF
Password-protecting a PDF is a standard compliance ask — especially for anything you email with an SSN, a medical record, or a financial statement. PennyPDF uses AES-256 encryption (the PDF 2.0 standard) rather than the weaker RC4 that older tools still default to.
The operation runs entirely in your browser using pdf-lib. Your password is used to derive the encryption key locally and is never transmitted. The file is encrypted before it leaves your device — if you cloud-share the output, nobody without the password can read it.
You can also set an 'owner' password separate from the 'user' password. The user password opens the file; the owner password is needed to change permissions or remove the password. Most users only need the user password.
How it works
- 1Upload your PDF at /protect.
- 2Type a password (12+ characters recommended). Optionally set an owner password.
- 3Pick permissions — typical is 'allow reading, forbid editing/copying'.
- 4Download the encrypted PDF.
Frequently asked
AES-256 or something weaker?+
AES-256 by default. Weaker modes (RC4-128, AES-128) are available for compatibility with very old PDF readers, but we don't recommend them.
Can I recover the password if I forget it?+
No. AES-256 is not brute-forceable with consumer hardware. Pick a password you'll remember, or store it in a password manager.
Does the password transmit over the network?+
No. Encryption happens in your browser. The password derives the key locally. Neither the password nor the unencrypted file leaves your machine.
Permissions I can set?+
Print, copy text, modify, fill forms, annotate, assemble. Each is a separate toggle.
Does this prevent screenshots?+
No — PDF permissions are enforced only by well-behaved viewers. Anyone with the file and the password can screenshot any page. For true DRM, you need a different product category.
Why PennyPDF
- No subscription. Ever.
- Coins never expire — use them in 5 years.
- Client-side processing for 14 of 22 tools.
- No watermarks at any tier.
- Per-operation pricing, shown before you click.
- Same coins for web + public API.