Lock PDF with Password 2026 — Free Online

Put an open password on a PDF, so it cannot be read without one. The file is encrypted with AES-256 in this browser tab — the password is never sent anywhere, which also means nobody can recover it for you.

What the encryption here actually is

The file is written as PDF 1.7 extension level 3 with security handler revision 5 — AES-256 in the specification's terms, V5/AESV3. That is the strongest cipher the PDF format defines, and it is applied to the page content itself, not to a wrapper around it. Open the locked file in a text editor and the words that were in the document are not there.

The distinction worth knowing is between this and a permissions-only lock. An open password means the bytes are unreadable without it. A permissions lock leaves the file readable and asks the reader program to behave. Only the first is encryption in the sense most people mean.

The header version is what selects the cipher, which is easy to get wrong: PDF 1.6 and 1.7 both give AES-128, and only 1.7 extension level 3 reaches 256-bit. A file can be genuinely encrypted at half the advertised strength with nothing on screen to show it.

  • AES-256, revision 5 — the strongest cipher the PDF spec defines
  • Applied to page content, so the text is not in the raw bytes
  • Set in this tab; the password is never transmitted

Choosing a password you will not lose

Length does more than punctuation. A four-word phrase you can picture beats eight scrambled characters on both counts — it is harder to search and easier to remember — and AES-256 means the only realistic attack is guessing the password itself.

Because nothing is uploaded, there is no account, no reset link and no copy of the file on a server. That is the point of doing it in the browser, and it is also the risk: a locked PDF whose password is gone is gone. Put the password somewhere before you close the tab, not after.

Keep the original unlocked file too. It is the only way back if the password is lost, and it costs nothing to leave a copy in place until you are sure the locked one opens.

Where a locked PDF will and will not open

Any current reader handles AES-256: Acrobat, Preview on macOS, Chrome and Edge's built-in viewers, and the PDF apps on iOS and Android all prompt for the password and open the file. Very old software — Acrobat 8 and earlier, some embedded print controllers — predates the cipher and will refuse.

Mail systems that scan attachments cannot read inside an encrypted PDF, so some scanners flag it or hold it. That is the file working as intended, but it is worth expecting if you are sending one to a corporate address.

Frequently Asked Questions

Can you recover my password if I forget it?

No. The password never leaves your browser, and neither does the file, so there is nothing on our side to recover from. AES-256 with a good password is not something we or anyone else can work around — keep a copy of the original.

Is AES-256 actually strong, or is that marketing?

It is the strongest cipher the PDF specification defines, and the file here is written as revision 5 so it really uses it rather than falling back to AES-128. The weak point is the password, not the cipher.

Does this stop someone forwarding the file?

No. Anyone can pass the file on; they just cannot open it without the password. If you send both to the same place, you have sent an unlocked PDF with extra steps.

Will it work on a scanned PDF?

Yes. Encryption applies to the file, not to what is inside it, so scans, forms and text documents are all treated the same.

Is the PDF uploaded to lock it?

No. It is read, encrypted and saved back in this tab. Nothing is sent to a server, which is why the password cannot be recovered.

Related free tools

More free pdf tools