How to Password Protect a PDF for Free — AES-128 Encryption, No Upload
Sending a contract, financial statement, or medical record as an email attachment is risky when the file is unprotected. Password protection adds a layer of access control that keeps contents private even if the email is intercepted or forwarded unexpectedly. This guide covers adding AES-128 encryption to any PDF for free, entirely in your browser, with no file upload at any step.
- 68% of data breaches involve a human element, including improperly shared unprotected documents (Verizon DBIR, 2024).
- AES-128 has no known practical attack and is NIST-approved through at least 2030 (NIST SP 800-131A Rev. 2).
- A user password blocks all access; an owner password restricts only actions like printing and copying.
- Use a four-word passphrase, not a short complex string. It's harder to crack and easier to share securely.
Why Password Protect a PDF?
The Verizon Data Breach Investigations Report 2024 found that 68% of data breaches involve a human element - including improperly shared or unprotected documents. The average cost of a data breach reached $4.88 million in 2024 (IBM Cost of a Data Breach Report, 2024). A password on a sensitive PDF costs nothing and takes under two minutes.
Most document leaks don't involve sophisticated hacking. They happen because a file was emailed to the wrong address, forwarded by the recipient, or left open on a shared screen. A user password means the file is unreadable without the correct passphrase, regardless of who ends up with it.
Beyond access control, owner passwords let you restrict what authorized readers can do. You can allow someone to view a contract but block them from printing it, copying the text, or extracting pages. PDF permission restrictions have been part of the format since PDF 1.3, standardized in 1999 (ISO 32000-1:2008 PDF specification).
How to Add a Password to a PDF with FusionPDF
The process takes under two minutes and your file never leaves your device. FusionPDF's Protect PDF tool applies AES-128 encryption entirely in your browser using the pdf-lib library. No account, no sign-up, no server upload at any point.
Go to fusionpdf.pro/protect in your browser. No account or sign-up is required.
Drop your file onto the page or click to select it. The file is read into your browser's memory only. Nothing is sent to any server at this step or any other.
Enter the user password recipients will need to open the file. Optionally set an owner password to restrict printing or copying. Choose a four-word passphrase for best security (see the section below on passwords).
Click Protect PDF. AES-128 encryption is applied in your browser. The protected file downloads immediately to your device.
Verify it worked: Open the downloaded PDF in any standard reader. You should be prompted for a password before the document opens. If the file opens without a prompt, check that you clicked Protect PDF (not just Download) before saving.
User Password vs. Owner Password - What's the Difference?
PDF encryption supports two distinct passwords with different effects. Most users only need one, but knowing the difference prevents common mistakes. A user password locks the file entirely; an owner password only restricts actions for people who can already open the document. You can set either or both independently.
| Type | Also Called | What It Does | When to Use It |
|---|---|---|---|
| User password | Open password | Required to open and view the PDF. Anyone without it sees only an encrypted file they cannot read. | Any time you want to restrict who can access the document at all. |
| Owner password | Permissions password | Controls what an authorized reader can do: print, copy text, annotate, fill forms, extract pages. | When you want to allow viewing but prevent printing, copying, or modification. |
If you set only an owner password (no user password), the document opens freely but restrictions apply in compliant readers. If you set both, the user password is required to open the file, and entering the owner password grants full permissions.
Important: Owner password restrictions are enforced by PDF reader software, not by the encryption itself. A determined user with the right technical tools can strip owner-only restrictions from a PDF. For genuine access control, always set a user (open) password. Consider also using the Redact tool for content you want permanently removed before sharing.
How Strong Is AES-128 Encryption?
NIST SP 800-131A Revision 2 states that AES-128 has no known practical attack and is approved for use through at least 2030. There are 2128 possible key combinations - roughly 340 undecillion. Even a system testing one trillion keys per second would take longer than the age of the universe to exhaust all possibilities.
PDF password protection has existed since PDF 1.3, introduced with Adobe Acrobat 4.0 in 1999. The AES-128 standard used in PDF 1.6 and later represents a significant upgrade from earlier 40-bit and 128-bit RC4 encryption used in older PDF versions (ISO 32000-1:2008 PDF specification).
The practical weak point is never the encryption - it's the password. A correctly implemented AES-128 password on a PDF cannot be cracked by brute force with current computing hardware, provided the password isn't a common word or short string. Weak passwords can be dictionary-attacked in seconds.
How to Choose a Strong PDF Password
NIST SP 800-63B recommends long passphrases over short complex strings. A password like atlas crane pepper moon has more than 50 bits of entropy - far beyond what a dictionary attack can crack - and is easier to communicate verbally than P@ssw0rd!. Length beats complexity every time.
The four-word passphrase method
Pick four unrelated common words and join them with a separator. Words you can picture are easier to remember and share. The randomness comes from the combination, not from special characters. Examples: river-clock-garden-wolf, blue-anvil-sugar-lamp.
What to avoid
- The document's filename or subject matter (first thing an attacker tries)
- The recipient's name or company name
- Dates, phone numbers, or common words from the document
- Passwords you reuse across other accounts
- Anything under 12 characters, even with symbols
Sharing the password securely: Don't include the password in the same email as the PDF. Send the password by SMS, phone call, or a separate email to a different address. This way an intercepted email reveals only the encrypted file, not the key to open it.
How to Remove a Password Later
If you need to unlock a PDF you own the password for, use FusionPDF's Unlock PDF tool. Enter the current password and the tool removes all protection and returns an unencrypted copy. Like the Protect tool, it runs entirely in your browser with no file upload.
If you've forgotten the password on a file you protected yourself, there's no practical recovery method for a properly AES-128 encrypted PDF. Keep a record of passwords you set, stored in a password manager rather than in a plain-text document.
For more detail on the unlock process, including what to do when you receive a locked PDF from someone else, see our full guide: Remove a PDF Password Free. If you want to add a visible security layer rather than an access restriction, see Add a Watermark to a PDF Free.
Frequently Asked Questions
How do I password protect a PDF for free without uploading it?
Go to fusionpdf.pro/protect, drop your PDF onto the page, enter the password you want to set, and click Protect PDF. AES-128 encryption is applied in your browser using the pdf-lib library. No file is ever sent to a server. The protected PDF downloads immediately to your device.
Is AES-128 strong enough to protect a PDF?
Yes. NIST SP 800-131A Revision 2 confirms AES-128 has no known practical attack and is approved for security-sensitive use through at least 2030. It's the same encryption used by banks and government agencies. The strength of your password matters more than the key length at this level - use a four-word passphrase for best results.
Can someone bypass a PDF password?
A user (open) password using AES-128 cannot be bypassed without the correct password - brute-force is not computationally feasible against a strong passphrase. Owner password restrictions, however, are enforced by reader software, not encryption. A determined user with technical tools can strip owner-only restrictions. For genuine access control, always set a user password.
How do I remove a password from a PDF I own?
Use the FusionPDF Unlock PDF tool. Enter the current password and the tool removes protection and returns an unencrypted copy. You must know the password - there is no practical way to unlock a properly AES-128 encrypted PDF without it. See our full guide: Remove a PDF Password Free.
Password Protect Your PDF Now
AES-128 encryption, free, no upload required. Runs in your browser in under 2 minutes.
Open Protect PDF Tool →