How to encrypt a PDF with AES-256
Lock a document with a real password, and understand what the encryption does and does not protect.
Encrypting a PDF means the file's contents are genuinely unreadable without the password. This is not the same as restricting permissions, which asks readers politely not to print or copy. Encryption is enforced by mathematics; permissions are enforced by convention.
The cipher used here is AES-256, the strongest the PDF specification defines. That part is settled. The part you control is the password.
The steps
- Upload the document.
- Set the open password readers will need, and confirm it.
- Optionally set a separate owner password that controls permissions.
- Choose what is allowed — printing, copying, modifying, annotating — then run the tool.
Your password is the weak link, not the cipher
AES-256 is not going to be broken. A six-character password protecting it will be, quickly, by software that tries millions of candidates per second. The strength of the whole arrangement is the strength of what you chose.
A long passphrase of several unrelated words beats a short string of substituted characters, and is far easier to pass along to whoever needs to open the document.
Two passwords, two different jobs
The open password — sometimes called the user password — is required to view the document at all. The owner password governs permissions and is what you would need later to change them. If you leave the owner password blank, it matches the open password.
If your goal is simply that people who should not have the document cannot read it, the open password is the one that matters.
There is no recovery
Nobody can recover the file if the password is lost — not us, not any service, not the recipient. Working encryption has no back door by definition. Store the password before you close the page, and send it to the recipient through a different channel than the document itself.
