ZasPDF Logo
arrow_backDashboard

Add Password to PDF (AES Encryption)

Protect your sensitive documents with military-grade AES encryption. Being Zero Cloud, no one else has access to your original files.

upload_file

Select PDF

or drag the file here

100% Local
Encryption Level

Password-protect a PDF with AES-256, without uploading it

Encrypt a PDF so it cannot be opened without the password. The encryption is performed in your browser, so neither the file nor the password is ever transmitted.

There is an obvious problem with encrypting a confidential document on a website: to do it, that site has to receive both the document and the password you are protecting it with. For a moment, a stranger's server holds the file in the clear along with the key. If the point of the exercise was confidentiality, that is a strange way to start.

This tool avoids the problem by not having a server in the loop. The encryption runs inside your browser tab, using an engine compiled to WebAssembly. Your PDF and your password stay on your machine from beginning to end.

The result is a standard encrypted PDF using AES-256, the strongest scheme the PDF specification defines. Any compliant reader — Acrobat, Preview, Chrome, Edge — will prompt for the password before displaying a single page.

AES-256 encryption

The strongest encryption the PDF format supports, applied by the same open-source engine that desktop tools use.

Your password never travels

The password is used to derive the key inside your browser. It is never sent anywhere, never logged and never stored.

Opens in any PDF reader

Standard PDF encryption, so recipients simply enter the password in whatever reader they already use.

How to password-protect a PDF

1

Select the PDF you want to encrypt.

2

Choose a strong password and type it in.

3

Encryption runs locally in your browser.

4

Download the protected file and share the password separately.

Neither your file nor your password is uploaded

This matters more here than on any other tool. Encrypting a document on a server means handing that server the plaintext document and the key at the same moment. Doing it in your own browser means there is no such moment.

When people reach for this

Emailing a document you would rather not leak

Email is not a private channel: it passes through servers you do not control and lands in an inbox that may be shared or breached. Encrypting the attachment means an intercepted copy is useless without the password.

Sending payroll, invoices or tax paperwork

Financial documents routinely contain bank details, salaries and tax identifiers. Many organisations require these to be encrypted in transit as a matter of policy.

Storing sensitive files in shared cloud storage

A shared drive folder is only as private as its permissions, which drift over time. An encrypted file stays protected even if the folder is shared more widely than intended.

Handing a document to a client or counterparty

A signed agreement or a medical report needs to reach one specific person. Encryption plus a password sent through a different channel gives you a simple second factor.

What actually happens to your file

Your PDF is read into memory and passed to pdfcpu, a mature open-source PDF library written in Go, which we compile to WebAssembly so it runs inside the browser rather than on a server.

Encryption uses AES with a 256-bit key, which is the default and the strongest option the library offers. The key is derived from the password you type, in the tab, and is discarded when the operation ends.

Both the user password (required to open the document) and the owner password (which governs permissions) are set to the same value. That is a deliberate simplification: a PDF whose owner password differs can have its restrictions stripped by many tools, so a single strong password is more honest than the illusion of two tiers.

The default permission set allows printing on the decrypted document. The encrypted file is then written out and handed to your browser as a download. At no point does the file or the password leave the tab.

What this does and does not protect against

  • Encryption is only as strong as the password. AES-256 is not brute-forcible, but a short or common password is guessable regardless of the cipher. Use a long passphrase.
  • There is no recovery. We do not hold your file or your password, so a forgotten password means the document is unreadable — by you as well as by anyone else. Store it in a password manager before you close the tab.
  • Once someone opens the document legitimately, they can do what they like with it. Permissions in the PDF specification are advisory, and many readers ignore them. Treat this as protecting the file in transit and at rest, not as controlling what a recipient does afterwards.
  • Sending the password in the same email as the file defeats the entire exercise. Use a different channel — a message, a call, a password manager share.
  • It does not protect a file already on a compromised machine. This encrypts a document; it does not secure the computer it sits on.

Compared with an online encryption service

This toolTypical cloud service
Who sees the fileOnly you.Their server, in the clear, before encrypting.
Who sees the passwordOnly you.Transmitted to their server.
Encryption strengthAES-256.Varies; sometimes weaker RC4.
File size limitsBounded only by your device's memory.Commonly capped on free tiers.
Works offlineYes, once the page has loaded.No.
Retention riskNone — nothing is uploaded.Depends on their retention policy.

Frequently Asked Questions

What encryption is actually used?expand_more
AES with a 256-bit key, the strongest scheme defined by the PDF specification. It is applied by pdfcpu, an established open-source library, compiled to WebAssembly so it runs in your browser.
Can you recover my password if I forget it?expand_more
No, and that is not a policy choice we could reverse. Your file and password never reach us, so there is nothing on our side to recover from. A forgotten password means the document cannot be opened. Save it in a password manager before closing the tab.
Can the protection be removed?expand_more
Yes, by anyone who has the password — our unlock tool does exactly that. Without the password, AES-256 is not something that gets brute-forced. The weak point is always password strength, never the cipher.
Will the recipient need special software?expand_more
No. This is standard PDF encryption, so Acrobat, Preview, Chrome, Edge and every mainstream reader will simply prompt for the password.
Can I stop the recipient from printing or copying?expand_more
Only advisorily. The PDF specification has permission flags, and this tool leaves printing allowed by default, but readers are free to ignore them and many do. Do not rely on permissions as a security control — encryption is the part that actually holds.
Should I send the password with the file?expand_more
No. Sending both in the same email means anyone who reads that email has both. Send the password through a different channel entirely.
Does encrypting change the document itself?expand_more
No. The pages, text and images are unchanged; the file is wrapped in an encryption layer. Decrypting with the password returns the original content.
Is there a file size limit?expand_more
No fixed one. Encryption happens in the browser tab, so the ceiling is your device's memory rather than a plan tier.

Related guides

RC4, AES-128, AES-256: what PDF password protection actually doesPDF encryption has a history of getting weaker as it gets more convenient, and it has a much bigger asterisk than most people realise: two different passwords, only one of which the cipher actually protects.9 min read →What PDF/A is, why your "normal" PDF probably isn't one, and how to checkPDF/A is the archival flavour of PDF that courts, registries and universities ask for. It forbids most of what makes an ordinary PDF convenient. Here is what it requires, why a file exported from Word usually fails, and how to verify one without paying for Acrobat.8 min read →A drawn signature and a digital signature are different things. Here is which one you needA signature drawn on screen and a certificate-based digital signature look similar on the page and have almost nothing in common underneath. This guide explains what each one actually is, what the law generally says about them, and when a picture of your signature is enough.8 min read →Watermarks that actually do something, and the ones that come off in two clicksA watermark is not encryption and not a signature; it is a mark on the page whose value depends entirely on what you expect it to do. This guide separates the three jobs a watermark can do — labelling, deterrence, tracing — and explains what makes a mark hard to remove and what makes it decorative.7 min read →What "unlocking" a PDF actually does: two passwords, one key, and the limits of the wordA PDF can have an open password, a permissions password, both or neither, and "unlock" means something different for each. This guide explains how the two passwords relate to the encryption key, why permission restrictions are so easy to strip, why an unknown open password is not, and where the ethical line sits.8 min read →

Tools that pair with this one

Unlock PDFRemove the protection later, when you have the password.Merge PDFAssemble the full document before encrypting it, not after.Sign PDFSign first — you cannot annotate an encrypted file without decrypting it.Compress PDFShrink the file before encryption, since encrypted files compress poorly.