scriptiii
100% Client-Side

AES-256 · in the tab

Protect a PDF with a password

Real AES-256 encryption inside this tab — the output is checked for its encryption dictionary before the page tells you it worked.

Encryption runs in this browser tab using a WebAssembly build served from this site. Your document is never uploaded, and no password is sent anywhere.

Short answer: drop the PDF, type the password, download. The file comes back encrypted with AES-256 and the page confirms the encryption dictionary is in the output. Nothing is uploaded and no password is stored, so a forgotten password cannot be recovered — not by you and not by this site.

Why a real security handler

Encrypting a PDF properly means the standard security handler: key derivation, the encryption dictionary, per-object streams and strings. Getting it subtly wrong produces a file that opens without a password in one reader and not at all in another. This page uses a library that implements that handler rather than a homegrown approximation, and it proves the result by re-reading its own output.

What the page verifies

After encryption the output is scanned for /Encrypt. If it is missing, the page says the operation failed instead of handing you a file that only looks locked. The same check — in reverse — is what makes the unlock tool trustworthy.

Password protection questions

Is this real encryption?

Yes. The PDF standard security handler is implemented by a real encryption library that runs in this tab, so the encrypting happens on your machine and no password leaves it. After it runs, the page reads the output bytes looking for the encryption dictionary and reports whether it is there — a tool that cannot show you that check is asking you to take its word.

What is the difference between the user and owner password?

The user password is what opens the document. The owner password controls permissions — printing, copying, editing — for viewers that honour the PDF permission flags. Leave the owner field empty and it defaults to the user password, which is what most people want.

AES-256 or AES-128?

AES-256 (PDF 2.0) unless you have a reason. It is the default here. AES-128 exists for old readers that never learned the newer handler, and it truncates passwords past 32 characters — the tool refuses a longer password rather than silently cutting it.

Can a password be recovered?

Not by this site. There is no backdoor, no recovery key and no copy of your file: encryption happens in the tab and the only output is the file you download. If you lose the password, the document is lost, which is what encryption means.

What does encryption not protect?

The file name, its size, and the fact that it is an encrypted PDF. Anyone who has the file can see that much. Protection here means the content requires the password — not that the file is invisible.

Related tools

Unlock PDFRemove a password you already know.PDF metadataStrip producer and XMP before sending.Merge PDFCombine files before locking them.