How to Password-Protect a PDF: Open Passwords vs Permissions, Free Methods, and What It Won't Protect

You're emailing a bank statement, a contract or a medical report and want only the intended person to open it. Or you're publishing an e-book and want to stop copying or printing. The obvious answer: "put a password on it."

But PDFs have two completely different passwords: one stops the file being opened and genuinely encrypts its content; the other only restricts printing, copying and editing — and that one is easy to get around. Mixing them up creates a false sense of security. This guide explains the difference, the free ways to protect a file, and how to share the password safely.

The two kinds of PDF password

Open password (user / document open password)

Setting it encrypts the entire contents — text, images, fonts. Any program trying to open the file asks for the password; without it, the data is meaningless.

Strength: with AES-256 encryption and a strong password, protection is very solid in practice. There's no known practical way to break AES-256 directly, so an attacker has to guess the password. In reality, the protection is only as strong as the password.

Weakness: a short or common password — 123456, a birth date, the company name — can be guessed quickly by cracking software.

Permissions password (owner password)

This doesn't stop opening or reading. It sets flags inside the file: "don't allow printing", "don't allow copying", "don't allow editing". Compliant software like Adobe Acrobat honours them.

The catch: enforcement depends on the software respecting the flags. The file itself is readable, so any program that ignores the flags can print and copy. Useful to signal intent and prevent casual misuse — not protection against a determined person.

Free ways to password-protect a PDF

1) Microsoft Word (when creating a PDF from Word)

1. Open the document in Word.
2. File → Save As → choose PDF.
3. Click Options.
4. Tick Encrypt the document with a password.
5. Click OK and enter the password twice.
6. Save.

That's an open password. It only works when creating a PDF from Word, not for protecting an existing PDF.

2) LibreOffice (free; protects anything it can open)

1. Open the document in LibreOffice Writer, or an existing PDF in LibreOffice Draw.
2. File → Export As → Export as PDF.
3. Security tab → Set Passwords.
4. Enter an open password, and optionally a permissions password.
5. Choose permissions: printing, changes, copying.
6. Export.

It supports both password types with detailed permissions. Downside: opening an existing PDF in Draw may shift formatting slightly.

3) Mac Preview

1. Open the PDF in Preview.
2. File → Export.
3. Tick Encrypt and enter a password.
4. Save.

Recent macOS versions also offer File → Edit Permissions for a permissions password.

4) qpdf (advanced, free and open source)

If you're comfortable with the command line, qpdf encrypts with AES-256:

qpdf --encrypt OPEN_PASSWORD OWNER_PASSWORD 256 -- input.pdf protected.pdf

Replace OPEN_PASSWORD and OWNER_PASSWORD with your passwords.

5) Adobe Acrobat (paid)

With Acrobat Pro: Tools → Protect → Encrypt with Password, with detailed options. The free Acrobat Reader can't add passwords.

Choosing a strong password

Because protection equals password strength:

• Length beats complexity: 14+ characters.
• A passphrase of 4–5 random words, like moon-window-orange-travel-7, is stronger and easier to remember than P@ss1.
• Avoid your name, birth date, company name, phone number and common passwords.
• Don't reuse passwords from important accounts.
• Use a password manager to generate and store them.

Sending the file and password safely

The most common mistake defeats the protection entirely: sending the password in the same email as the file. Whoever gets into that mailbox gets both.

Do this instead: 1. Email the protected file. 2. Send the password through a different channel: a text message, a phone call, or a different messaging app. 3. Or agree on a password rule in advance for a type of document — the way banks often build statement passwords from details only the account holder knows.

What a password won't protect

• Not from the recipient: once they open it, they can save an unprotected copy, screenshot or print to a new PDF.
• Not the file name: attachment names are visible to everyone. Don't call it Salaries-2026-Confidential.pdf if the name itself is sensitive.
• Not with a weak password: a 6-digit number is guessed quickly.
• It may get the file rejected: many government and university upload portals refuse encrypted PDFs. Don't protect files you'll upload to portals — see PDF upload rejected? How to fix it.

Layered protection

The strongest approach usually combines layers: send only what's needed, watermark it with the recipient's name, then add an open password.

A simple policy for small businesses

If your office regularly sends sensitive documents — payroll, statements, contracts:

1. Classify documents: public, internal, confidential.
2. Only confidential ones get an open password with AES-256.
3. Passwords go by text message or another app — never the same email.
4. Watermark confidential documents with the recipient and date.
5. Neutral file names, e.g. Document-2026-11-07.pdf.
6. Minimum necessary: don't send a whole document if one page will do.
7. A simple log: who sent what, to whom, when.

None of this needs paid software, and it cuts leak risk considerably.

File encryption vs channel encryption

For highly sensitive documents, encrypting the file itself is the only protection that travels with it after it leaves your hands.

Forgot the password to your own file?

• Permissions password: the file opens and reads. If you own it, open it and print to a new PDF if printing is allowed, or recreate it from the source.
• Open password: if you have the unprotected original or Word file, recreate it. If it came from an organisation like a bank, request a new copy or ask how the password is formed — it's often based on your details.

Don't try to break protection on a file you don't own or aren't entitled to open; that may be illegal.

FAQ

What's the difference between an open password and a permissions password?

The first encrypts the file so it can't be read without the password. The second only restricts printing, copying and editing, and relies on software honouring it.

Is PDF password protection actually secure?

An open password with AES-256 and a long password is secure in practice. Permission restrictions are weak.

How do I protect an existing PDF for free without Acrobat?

Open it in LibreOffice Draw and export with a password, use Export with encryption in Mac Preview, or use qpdf.

Can I upload a password-protected PDF to a government portal?

Usually not — most portals reject encrypted files. Upload an unprotected copy.

Should I use a watermark instead of a password?

They do different jobs: a password prevents reading; a watermark deters reuse and helps trace leaks. Use both together.

Does WPPR add passwords?

Not currently. Use Word, LibreOffice or Preview — and prepare the file first with WPPR tools (merge, compress, watermark) in your browser without uploading.

Bottom line

For real protection, use an open password with AES-256 encryption and a long password, sent through a different channel from the file. Printing and copying restrictions are a message, not a lock. For the strongest protection, send the minimum necessary and watermark it with the recipient's name.

Prepare your file before protecting it with Watermark PDF and Split PDF — free, and nothing is uploaded.

Sources

• PDF: encryption and signatures (Wikipedia)
• Advanced Encryption Standard (Wikipedia)
• qpdf
• LibreOffice
• Password strength (Wikipedia)