You’re about to email a payslip, a scanned ID, or a signed contract, and you want to add some kind of lock before it goes out. So you zip the file and set a password on the zip, or you just write “please don’t share this” in the email and hope for the best. Both feel like you’ve done something. Neither one touches the PDF itself — the file inside that zip, or the attachment sitting in someone’s downloads folder, opens in any PDF reader with zero resistance the moment someone has it. If the goal is that the file needs a password to open, not just that it arrived in a slightly more annoying wrapper, none of that actually gets you there.

What doesn’t count as protecting the PDF

A few habits get treated as “good enough” that don’t hold up:

  • A password-protected zip. This protects the zip archive, not the PDF. Once someone extracts the file — which is the entire point of a zip — the PDF itself has no password at all. It also does nothing for anyone who already has the extracted file, forwarded separately, or previewed by an app that unzips automatically. And even before extraction, the zip’s own lock is often weaker than it looks: plenty of zip tools — including the built-in “compress” option on Windows and macOS — still default to the old ZipCrypto scheme instead of AES, and ZipCrypto is the kind of thing password-cracking tools get through in minutes, not years.
  • Renaming the file or burying it in a folder. Obscurity isn’t a lock. Anyone who receives the actual file can open it, full stop.
  • A note asking people not to share it. This relies entirely on the recipient’s judgment and memory. It’s a reasonable courtesy to include, but it’s not a technical control — the file opens for anyone who has it, forwarded or not, whether or not they read the note.

The common thread: all three add friction around the file without changing what the file itself will do when someone double-clicks it. A real lock has to live inside the PDF, enforced by the format itself, so that every PDF reader — not just the sender’s good intentions — requires the password before showing a single page.

What actual encryption does differently

Password Protect a PDF encrypts the file using AES-256 — the same encryption strength used for the PDF standard’s strongest setting, and the kind of cipher used to protect data at rest generally. Once that runs, the PDF’s content is scrambled in the file itself. There’s no version of the file floating around that opens without the password; the one you send is the encrypted one. Open it in Adobe Acrobat, Preview, a phone’s PDF viewer, a browser tab — every one of them stops at the same password prompt, because the requirement isn’t a setting or a note, it’s baked into how the bytes of the file are structured.

That’s the practical difference from the zip-password approach: a password on a zip is a gate in front of the file. A password on the PDF is the file — there’s nothing to extract your way past.

Why there’s one password, not two

PDF encryption technically supports two different passwords: an open password, required just to view the file, and a separate owner password, which only restricts what someone can do once they’re already reading it — printing, copying, editing. If you’ve used a desktop PDF tool before, you might expect to be asked which kind you want, or to see a checklist of permissions to disable.

Password Protect a PDF doesn’t ask, on purpose. It sets a single password that’s required to open the file — full stop. There’s no separate permissions layer, because permission restrictions aren’t really security in the first place: they’re only honored by PDF readers that choose to honor them, and anyone who wants past a “no printing” or “no copying” flag can usually just open the file and print it straight through to a new, unrestricted PDF. An owner-password-only lock stops accidental misuse, not someone who’s actually trying. If what you need is “nobody without the password can see this at all,” the open password is the one of the two that actually does that — which is why it’s the only one this tool sets.

Who actually needs this

Not every attachment needs encryption — most internal, low-stakes files are fine as-is. This is for the documents where you’d actually mind if the wrong person opened them:

  • Payslips and salary letters, especially when sent to a personal inbox or a shared family email account.
  • Tax documents and financial statements — PAN, Aadhaar, bank statements, ITR filings — anything with identifying numbers you wouldn’t want sitting unprotected in someone’s downloads folder.
  • Medical records and reports, where the sensitivity is obvious and the recipient (or their inbox) may not be the only one with access to that device.
  • Contracts and signed agreements before they’re fully executed, so a draft in transit isn’t readable if it lands somewhere unintended.
  • Anything forwarded through a chain of people, where you don’t control what happens to the file after the first recipient gets it, but you do want to control who can actually open it.

If the file is genuinely not sensitive, this is unnecessary friction — nobody wants to type a password to open a meeting agenda. Save it for the documents where “only the intended person can open this” actually matters.

Using it

  1. Upload your PDF to Password Protect a PDF.
  2. Type a password and confirm it.
  3. Download the encrypted file and send that one — every copy of it now requires the password to open, in any reader, anywhere.

Encryption happens entirely in your browser using qpdf, an open-source PDF library compiled to run client-side. Your file and your password are never uploaded anywhere, which matters doubly here: you’re protecting a sensitive document, and you shouldn’t have to hand it — or its password — to a server to do that.

The tradeoff worth knowing before you use it

This is real encryption, which means it has a real, unforgiving property: there’s no back door. If you forget the password, or the person you sent it to loses it, the file cannot be recovered — not by us, not by any PDF tool, not by anyone. The same lock that keeps everyone else out keeps out a locked-out owner too. That’s not a flaw in the tool; it’s what “the encryption actually works” means. A password recovery option would be a weakness someone else could exploit.

In practice, that means treating the password the way you’d treat any credential that matters: store it in a password manager rather than a sticky note or a chat message you might lose, and if you’re sending the file to someone else, share the password through a different channel than the one carrying the file — a text message or a call, not the same email thread. And if the recipient later needs the password removed for their own convenience — say, once it’s safely stored on their end — Unlock PDF removes an existing password from a PDF you already know the password to, entirely in-browser as well.