A contract sent over email gets forwarded to unintended recipients three times before anyone notices. Password protection on the PDF would have required the sender to share the password through a separate channel, dramatically reducing accidental forwarding. PDFKits Protect PDF encrypts any PDF with AES-256 (the same standard used by US government top-secret communications) directly in your browser. Free, no signup, no upload.
PDF encryption uses two passwords: the user password (required to open the file) and the owner password (optional, controls editing/printing/copying permissions). PDFKits supports both, plus permission granularity (allow viewing but not printing, allow printing low-resolution only, prevent text copying, etc.). The encryption runs via the Web Crypto API in your browser — your password and file never leave your device, which means the protection is structurally trustworthy.
Drop the PDF into the tool. PDFKits validates the file and detects whether it's already encrypted (in which case you'd use Unlock PDF first, or supply the existing owner password).
Enter the user password (required to open). Optionally enter a separate owner password to set permission restrictions: prevent printing, prevent copying text, prevent editing, prevent extracting content for accessibility. Re-type both passwords to confirm — there's no recovery if you lose them.
Click Protect PDF. PDFKits uses pdf-lib + Web Crypto to apply AES-256-CBC encryption on every object in the PDF. The encrypted file downloads directly. From now on, recipients need the user password to open it — strong protection for sensitive documents.
Attorneys sending settlement drafts, divorce filings, or contracts protect them with a password shared separately (by phone or SMS). Even if the email is forwarded or intercepted, the content remains protected.
Public company finance teams encrypt quarterly earnings drafts before circulating internally — preventing accidental leaks that could trigger SEC selective-disclosure issues.
Healthcare practices encrypt patient records (HIPAA requires protected transmission of PHI). AES-256 protection meets HIPAA's "encryption in transit" requirements when combined with secure delivery.
Sending a passport scan or ID photo to a service provider? Encrypt the PDF first and share the password by SMS — limits exposure if the email is intercepted.
Adobe Acrobat Pro DC supports AES-256 encryption but costs $19.99/month. Online services that encrypt PDFs (Smallpdf, iLovePDF) upload your file — meaning your unencrypted PDF lands on their servers first, defeating the purpose. PDFKits encrypts in your browser via Web Crypto API. Your password and unencrypted PDF never leave your device. Truly secure, truly free.
AES-256-CBC, the modern industry standard. Older PDF tools may use RC4 (40-bit or 128-bit) which is now considered weak — PDFKits never falls back to RC4.
There is no recovery. AES-256 is computationally infeasible to brute-force. Always keep a backup of your password in a password manager.
Yes. AES-256 PDF encryption is supported by Adobe Reader, Preview (macOS), Chrome PDF viewer, and any modern PDF tool. Recipients just enter the password when prompted.
No. The visual content is identical — only access control changes.
Yes. Set only the owner password (with permissions like 'no printing') and leave the user password empty. The file opens freely but printing is blocked.
Never. All encryption happens in your browser via the Web Crypto API. Your password and unencrypted PDF stay on your device.
Yes, using our Unlock PDF tool with your owner password to remove encryption, or by re-applying it after editing.