How to password protect a PDF for free in your browser

Some PDFs should not open for just anyone: a contract with salary figures, a scan of an ID, financial statements headed for an email thread you do not fully control. Password-protecting the file is the standard answer — the PDF format has built-in encryption, and any mainstream PDF reader can open a protected file once the password is entered.

Here is the part that should give you pause: most free "protect a PDF" websites ask you to upload the document and type the password on their site. You hand a third party the sensitive file and the key to it in the same breath. The pdfmend editor does neither — the document is encrypted in your browser, and the password you type never leaves it.

• The PDF on your device (up to 100 MiB and 250 pages during the free launch).
• A strong password you can store safely — more on choosing one below.
• Any modern desktop or mobile browser. No account, no install, and no watermark on the export.

1. Open the editor and choose your PDF. Your browser reads the file locally — nothing is sent to a server.
2. Make any edits first — fill fields, sign, remove pages — because protection is applied to the exported copy as it stands.
3. Open More export options and choose Protect.
4. Enter the password you want the file to require. It is used for encryption right there in your browser and is never transmitted anywhere.
5. Export. The protected copy is saved to your device; anyone opening it will be prompted for the password in their PDF reader.
6. Share the password through a different channel than the file — if both travel in the same email, the protection is theater.

Your original file on disk is untouched. The protected file is a new copy, so you keep an unprotected original for your own records — store it somewhere appropriate for its contents.

Protect applies standard PDF encryption to the exported file. That is the honest headline, and it cuts both ways: standard encryption is solid, but the password is the whole game. A short or guessable password can be attacked by simple trial and error, and no encryption scheme can save a password like the company name plus the year. A few practical rules:

• Length beats cleverness. A passphrase of several unrelated words is both strong and typeable — the recipient has to enter this, possibly on a phone.
• Do not reuse a password the recipient or anyone else already knows from another context.
• Never send the password alongside the file. Use a separate channel: a message app, a phone call, in person.
• Decide how you will remember it. A protected PDF with a forgotten password is effectively lost — pdfmend cannot recover or remove a password for you, precisely because it never had it.

One distinction matters enough to get its own section: a password controls who can open the file. It does nothing about what is inside. The moment someone legitimate opens the PDF, everything in it is visible — and they can save, copy, or forward an unprotected version.

So if the real goal is that a recipient must never see a particular name, number, or paragraph, a password is the wrong tool. That content has to be removed, not locked. See the redaction guide for how pdfmend's Delete text (exp.) tool handles true content removal and, just as importantly, where it fails safely. Use Protect for transport and storage; use redaction for content you are cutting out; use both when both apply.

Encryption is meant to shrink the set of people who can read a document. Uploading the file and its password to a web service does the opposite first: it briefly expands that set to include a server you do not control. Whatever the service's intentions, you cannot audit its retention, its logs, or its breaches.

Local protection has no such gap. The document is encrypted on your device with a password that exists only in your browser and your head. There is no upload operation and no server-side copy — the privacy page details exactly what pdfmend does and does not process.