How to Password Protect a PDF for Free

Not every "password protect a PDF" tool actually encrypts anything. Some just show a password prompt in their own viewer while the underlying file remains fully readable by any other PDF tool. Here's how to add password protection that's real — and how to tell the difference.

Protect it in your browser (no upload, free)

The Protect PDF tool on keptlocal encrypts a PDF with a password entirely on your device.

1. Drop your PDF onto the tool.
2. Enter a password and confirm it.
3. Click Protect PDF. The encrypted file downloads immediately, named with a -protected suffix.

The file is encrypted with AES-256 before it ever leaves your browser — there's no server round-trip during which an unencrypted copy could be intercepted or logged.

Why "password protected" doesn't always mean encrypted

This distinction matters more than most people realize. A PDF can be "protected" in two structurally different ways:

• Permission restrictions only — the file sets flags saying "don't allow editing" or "don't allow copying," but the content itself is stored in plain, unencrypted form. Any tool that doesn't respect those flags (and plenty don't) can open and read the file freely. This is what some free "protect PDF" tools actually produce — a permissions wrapper, not real security.
• Real encryption — the file's content is mathematically transformed using a key derived from the password. Without the password, the content is unrecoverable; there's no flag to ignore because there's nothing readable underneath. This is what AES-256 encryption, done properly, provides — and it's what this tool does.

If you're protecting a document because its contents are genuinely sensitive — financial records, medical information, a contract with confidential terms — the distinction isn't academic. Only real encryption keeps the content safe if the file ends up somewhere you didn't intend.

What permissions are set

This tool sets the PDF's owner permissions to allow high-resolution printing and form-filling, while restricting editing, content copying, and annotations. Someone with the password can open and print the document normally; extracting the text or modifying the content requires more than just the open password. These are standard, sensible defaults for a document you want people to be able to read and print but not alter or repurpose.

Choosing a password

The encryption is only as strong as the password protecting it. A short or guessable password (a name, a birthdate, "password123") undermines AES-256 just as badly as no encryption at all, because an attacker doesn't need to break the cipher — they just need to guess the password. Use a random password of at least 12 characters, or generate one with keptlocal's Password Generator, and store it in a password manager rather than trying to remember it.

Privacy: what happens to your file

Encryption happens entirely in your browser via a JavaScript PDF library — your file and your password are never transmitted anywhere. Open DevTools → Network while protecting a file and you'll see zero outbound requests. That matters specifically for this tool: uploading a file to add password protection, to a server that could log the password or the unencrypted content in transit, defeats much of the point of encrypting it in the first place.

Encrypt a PDF now with keptlocal's free Protect PDF tool — no upload, no signup. Need to remove a password instead? Use Unlock PDF.