Password protect a PDF
Real AES-256 encryption, applied in this tab. The document cannot be read without the password — not hidden, not flagged, genuinely encrypted — and neither the file nor the password you choose goes anywhere near a server.
Which is the whole point on this page. Doing this on a website means giving one stranger the locked thing and the key to it in the same request.
Drop a PDF here
It is encrypted in this tab with AES-256. Nothing is uploaded.
or drop a folder here, or paste an image with Ctrl + V
Nothing is uploaded. The encryption runs on your own processor, in this tab.
Encryption against permissions
These are the two things a PDF can do and they are not the same. Setting a password to open the document encrypts it: without the password the contents are ciphertext, and no reader, however badly behaved, can show them to anyone.
Setting permissions — no printing, no copying, no editing — does not encrypt anything on its own. It records flags and asks readers to respect them. Acrobat does, Preview does, most do; anything that decides not to can print your document without breaking a thing. Use permissions to express intent and the password to actually withhold the file.
| Password to open | Permission flags | |
|---|---|---|
| Mechanism | AES-256 encryption | A note in the file |
| Stops a determined reader | Yes | No |
| Stops an ordinary one | Yes | Usually |
| Recoverable if lost | No, by design | Not applicable |
Why only AES-256 is offered
The format supports four schemes and three of them are worse. RC4 at 40 bits was breakable when it was specified. RC4 at 128 bits is broken now. AES-128 as PDF uses it derives its key through MD5, which is fast and therefore cheap to attack by guessing.
AES-256 in its ISO 32000-2 form uses a hash designed to be slow and unpredictable: at least sixty-four rounds of AES over sixty-four copies of the input, with the round count depending on the data so it cannot be short-circuited. That is what makes a guessed password expensive rather than instant. Offering the old schemes as a dropdown would only let someone pick a worse outcome without knowing it.
The password is the whole security model
Every part of this is derived from what you type. There is no server-side key, no account, and no reset link — which is what makes it strong and also what makes it unforgiving. A protected PDF whose password has been lost is not recoverable by us, by Adobe, or by anyone.
So: put it in a password manager before you send the file, and send the password by a different route than the document. Emailing an encrypted PDF and its password in the same message protects the file against precisely nobody. If you need a password worth using, generate one — it is on the same principle as this page, and never leaves your machine either.
What happens to the document
Nothing visible. Pages are kept as the objects they already are, so text stays selectable, vectors stay sharp and images keep their original compression — the encryption wraps the file rather than redrawing it. Someone with the password sees exactly the document you started with.
Do keep the original. Encryption is not reversible without the password by design, so the protected copy is the only copy if you delete the other one. When you need to undo it later, the password comes off here.
What a password does not do
It does not hide anything from someone you gave the password to — including the parts of the document you would rather they did not read. If a page contains a bank account number or a name that should not be in the copy you are sending, encryption is the wrong tool: redact it, which destroys the text rather than locking the door in front of it.
It also does not clean the document's properties. Author, creating application and timestamps sit in the file and, encrypted or not, are visible to anyone who can open it — worth a look before sending anything outside your organisation.
Questions
How do I password protect a PDF?
Drop the file in, choose a password, and download the protected copy. It is encrypted with AES-256 in this tab — the document is never uploaded, and neither is the password.
What encryption does this use?
AES-256 as specified in ISO 32000-2, which is the strongest the PDF format defines and what every current reader supports. The older schemes — RC4, and AES-128 whose key is derived through MD5 — are readable by this site but never written by it, because writing one would mean producing a weaker document for no benefit.
Can the password be recovered if I forget it?
No. There is no recovery, no back door and no reset — the key is derived from the password and exists nowhere else. Put it in a password manager before you send the file, because a protected PDF whose password is lost is a file nobody will read again.
What is the owner password for?
It controls permissions — printing, copying and editing — rather than opening. Leave it blank and it matches the password you set. Set it separately if you want colleagues to be able to open the document with one password while restricting what they can do without the other.
Do the permission settings actually stop anyone?
Not really, and it is better to know that. Permissions are flags recorded in the document; the specification asks readers to honour them and most do, but anything that can decrypt the file can ignore them. Treat them as a signal of intent. Only the password to open it withholds anything.
Is the document uploaded?
No. Consider what a service doing this on a server necessarily has: your confidential document and the password you chose for it, at the same moment, on hardware you do not control. That is the arrangement this page exists to avoid — the encryption happens in this tab and no request carries any of it.
Will the protected file open on a phone?
Yes. AES-256 encryption has been supported since Acrobat X, and iOS, Android, Chrome, Edge, Preview and every current PDF reader handle it. Very old software — Acrobat 8 and before — cannot, which is the one case where an older scheme would have helped.
What BriskFile will not do to you
-
Your files never leave your device
Every conversion runs in your browser. Open DevTools, watch the Network tab, and you will see no upload — because there is not one.
-
No account, no email, no watermark
Nothing to sign up for and nothing stamped on your images. There is no step between choosing a file and getting it back.
-
No limits at the download button
No daily cap, no file counter, no "upgrade to download". If the tool starts a job, it finishes it.
-
Checkable, not just claimed
Open the Network tab and convert something — nothing goes out. Or load the page, disconnect, and watch it keep working: the tool is already on your machine, and your file never leaves it.