How it works : PDF password
The direction is deduced from the file: a document in the clear gets locked, a protected document gets opened. The method is shown before the act, revision included, and the file you get is REOPENED to check that it really opens.
Putting a password on a document you are about to email is the most common protective gesture there is, and it is the one most often performed on an unknown website. A payslip, a statement, a quote: the document is uploaded in the clear to a stranger so they can protect it. Here, it does not leave.
The direction of the operation is deduced from the file itself. Drop in a document in the clear: the tool offers to lock it. Drop in a protected document: the tool offers to open it, if you have the password. Same principle as the safe in the security corner, and for the same reason: you already chose the direction when you chose your file.
One thing is said here and almost nowhere else: PDF has TWO levels of AES-256, revision 5 and revision 6, and they are nothing like equivalent. Revision 5 verifies your password in a single computation, which lets a machine try hundreds of millions per second. Revision 6 deliberately slows that computation down. The library we embed only writes revision 5. We do not hide it: we show it before the act, and we send you off to build a real passphrase.
How it works
- Drop your PDF in. The tool says straight away whether it is in the clear or already protected, and offers the matching gesture.
- Read the method shown: the algorithm, the revision, the key length, and what gets encrypted. Then type the password. It stays visible, and the page says why.
- Click. The file arrives, and the tool REOPENS it to check that it really opens with the password you just chose. It also tells you what it read in the bytes of the produced file.
Formats accepted
PDFs only. To put any other kind of file under a password, the “Encrypt and decrypt a file” tool in the security corner uses stronger encryption with a slow key derivation: that is the right choice whenever the PDF format is not mandatory.
PDF document
In the clear, to protect it; or already protected, to open it. The page content is not reworked: it is encrypted as it is, then handed back as it is.
Its limits
AES-256 revision 5, not revision 6
Revision 5 is an extension published by Adobe in 2008: it verifies the password with a SINGLE pass of SHA-256. Nothing slows down someone trying passwords offline, and published measurements from attack tools show four to five orders of magnitude difference against revision 6, which uses an iterated hash. Revision 6 is also the only one the PDF 2.0 standard does not deprecate. The library we embed writes only revision 5: that is a real limit, and the practical consequence is simple. A short password protects nothing here: use a passphrase of several words, and the “Build a passphrase” tool builds one.
Not every PDF reader opens revision 5
We checked inside the source code of the engines: Chrome's and Firefox's both implement revision 5, and Adobe Acrobat has opened it since version 9. For macOS and iOS Preview, and for Android readers, we found NO first-hand source: so we do not claim it. If the recipient absolutely must be able to open the file, try it with them first.
Print and copy restrictions protect nothing
PDF lets you ask a reader to forbid printing or copying. That is only a request: the file is decrypted the moment it is opened, and any reader may choose to ignore it. So we do not show those checkboxes: it would be selling a lock that is a sticker. Only the opening password really protects anything.
A lost password cannot be recovered
There is no spare key, here or anywhere else: nobody receives your file, and the password never leaves your tab. A document whose password is lost is a lost document. That is why the password stays VISIBLE while you type it.
80 MB
The document is opened entirely in memory, and its encrypted version lives beside it. That is the honest limit of a tab on a modest device.
An electronic signature on the document does not survive
Encrypting a file rewrites it, and a signature seals the whole file: it no longer verifies afterwards. No tool can do both.
Questions about this tool
Are my document and my password sent anywhere?
No, and it is checkable in thirty seconds. Open the inspector with the F12 key, “Network” tab, clear the list, then drop the document in, type the password and click. Not a single line appears. Cut your connection and do it again: the tool behaves the same. The password never leaves the field you typed it into.
Why do you talk about “revision 5”? Other sites just say AES-256.
Because saying “AES-256” without saying the revision hides the essential part. The encryption algorithm is the same; what changes is how your password is verified. In revision 5 it is a single SHA-256 computation: a graphics card tries hundreds of millions per second. In revision 6 the computation is deliberately long, and the same hardware only tries a few thousand. Both files announce “AES-256”. Only one resists someone who has your file and time.
So it is not secure?
It is exactly as secure as your password, and no more. With “Invoice2026”, no. With a phrase of six randomly drawn words, yes, comfortably: even at hundreds of millions of attempts per second, the number of combinations stays out of reach. That is why the tool shows the warning before the act and points to the passphrase builder. And if the PDF format is not mandatory, the safe in the security corner uses a deliberately slow key derivation: that is stronger.
Why do you not offer to forbid printing or copying?
Because those are requests, not locks. PDF lets you write “do not print” into the file, but the content is decrypted as soon as it is opened, and a reader that ignores the request prints anyway. Many tools show those checkboxes because they are reassuring. We do not show them because they protect nothing, and pretending otherwise would be exactly the kind of lie this site exists not to tell.
Will the recipient be able to open it?
In Chrome and Firefox, yes: we checked in the source code of their PDF engines that they can read this revision. Adobe Acrobat has opened it since version 9. For macOS and iOS Preview and for Android readers we found no first-hand source, so we do not claim it. If opening is critical, do a trial run with the recipient before sending the real document.
I lost the password of an old PDF. Can you open it?
No, and nobody can do it honestly. This tool opens a protected document when you SUPPLY the password: it does not guess it. Services promising to “unlock” a PDF without a password usually exploit the fact that many PDFs are not really encrypted, only marked “do not print”, and they ask you to upload the file to them. Here, without the password, there is nothing to be done.
Does the protected file keep my name anywhere?
Not if you leave the checkbox ticked: the tool removes the document's identity card and its XML block before encrypting. This detail has a precise technical reason: depending on how an encrypted document is saved, those texts can stay readable IN THE CLEAR inside the protected file. We measured it, we save in the only way that does not leak, and the test lock searches for those values in the clear in every produced file.
The direction is deduced from the file: a document in the clear gets locked, a protected document gets opened. The method is shown before the act, revision included, and the file you get is REOPENED to check that it really opens.
VerifyThe proof, step by stepThe network inspector check, explained one gesture at a time, with screenshots.
The cornerThe PDF cornerMerge, split, sign, fill, slim down. A PDF should never have to travel to a stranger to be cut in two.