PDF Password Protect & Lock

Sending a raw, editable contract or salary schedule over email lets anyone copy paragraphs, scrape numbers, or alter text objects in a desktop editor. You can password protect PDF files right in your browser by hardening the document into flattened, non-selectable page streams, stamping security metadata locks, or wrapping the file inside an AES-256-GCM encrypted vault that requires a passphrase to decrypt.

When you need to password protect PDF documents or lock text layers

Two very different threats come up when distributing sensitive PDFs outside your organization, and each requires a different defense.

The first threat is unauthorized copying, scraping, or silent alteration after the recipient opens the file. Standard PDF permission flags (sometimes called an Owner Password) are notoriously weak because many third-party viewers simply ignore the "Do Not Copy" bit in the header and let users highlight the vector text anyway. Converting the vector text layer into flattened 150 DPI page bitmaps physically removes the underlying character strings so nobody can highlight, copy-paste, or edit a single digit of an invoice or legal exhibit.

The second threat is unauthorized interception in transit - for instance, emailing a tax return, medical record, or M&A term sheet across shared inboxes where only a specific person with a shared secret should be able to open the file at all. For that scenario, wrapping the PDF payload in an authenticated AES-256-GCM cipher using PBKDF2-SHA256 key derivation ensures that without the exact password, the file bytes are mathematically indistinguishable from random noise.

Steps to harden and lock your PDF in the browser

1. Drop your confidential PDF into the upload box or click Select PDF File(s) to load it into local browser memory.
2. Enter a strong Document Access Password in the left panel, or click Generate Random Password to create a 16-character cryptographic key and check the live entropy strength bar.
3. Choose your Protection & Hardening Mode: Hardened Flattened PDF (converts editable vector text into tamper-proof raster pages with optional security footer stamps) or AES-256-GCM Self-Decrypting Vault (wraps the PDF in an encrypted container requiring your password to unlock).
4. Toggle your desired restriction notices (Lock Text Copying, Lock Form Editing, Stamp Security Notice), then click Protect & Download to save the protected file.

What happens under the hood in each protection mode

Because browser-based security tools should be transparent about their cryptography and structural changes, here is what each control in the sidebar actually executes on your document.

• Live password entropy calculator: As you type a password, the workspace calculates its bit entropy based on character pool size (lowercase, uppercase, digits, symbols) and length, flagging weak keys under 50 bits and confirming strong keys above 80 bits.
• One-click CSPRNG password generator: Uses window.crypto.getRandomValues to generate a 16-character random password (~104 bits of entropy) that you can copy to your clipboard with one click.
• Hardened Flattened PDF mode: Renders each page through PDF.js at crisp print resolution, embeds optional micro-stamped security headers (including a SHA-256 document fingerprint prefix), strips editable AcroForm inputs and author metadata, and rebuilds the PDF via pdf-lib so zero editable text nodes remain.
• AES-256-GCM Encrypted Vault mode: Derives a 256-bit key from your password using PBKDF2-HMAC-SHA256 with 100,000 iterations and a random 16-byte salt, encrypts the raw PDF bytes using AES-256-GCM with a random 12-byte initialization vector (IV), and packages the ciphertext into a zero-dependency HTML vault file that any web browser can decrypt offline when given the password.
• Zero-knowledge local execution: Neither your document nor your password is ever transmitted over the internet.

Worked example: locking a 16-page executive compensation packet

Suppose you have Exec-Comp-Schedule-2026.pdf (16 pages, 890 KB) containing vector spreadsheet tables and digital signatures. You want two deliverables:

1. A read-only PDF for the board portal where members can view pages immediately without typing a password, but cannot highlight, copy, or edit the salary figures.
2. An encrypted archive copy for email transmission that cannot be opened at all without a 16-character key.

In the workspace:

• First, you select Hardened Flattened PDF, enable Flatten Editable Text & Forms and Stamp Security Header, and export Exec-Comp-Schedule-2026-protected.pdf (1,420 KB). Opening that file in any PDF viewer shows crisp pages where the cursor cannot select or alter a single number.
• Next, you click Generate Random Password (producing a 16-character key with 104.8 bits of entropy), switch the mode to AES-256-GCM Encrypted Vault, and export Exec-Comp-Schedule-2026-vault.html (1,190 KB due to Base64 ciphertext encoding). When the recipient opens that vault file in Chrome, Safari, or Edge, they see a password prompt; entering the 16-character password decrypts and downloads the exact original 890 KB PDF offline.

Important caveats on PDF permissions and password recovery

Always distinguish between flattening and encryption. When you export a Hardened Flattened PDF, anyone who has the file can open and read it visually in a standard PDF viewer, and could theoretically run Optical Character Recognition (OCR) on the page images - its purpose is preventing casual copy-pasting, form tampering, and vector object editing. When you need true cryptographic confidentiality so nobody can view the pages without a password, use the AES-256-GCM Vault export.

Also remember that because all encryption happens locally inside your browser with zero server involvement, there is no "Forgot Password" reset link. If you encrypt a file in AES-256-GCM Vault mode and lose the password, the ciphertext cannot be recovered. Copy the password into your password manager before closing the tab.

How your files and keys stay private

All cryptographic operations use your browser's native Web Crypto API (window.crypto.subtle), and all PDF page rendering uses local PDF.js and pdf-lib buffers. No network calls send your PDF bytes, filenames, or passwords anywhere.

Related security and PDF tools

Need to remove an existing open password from a bank statement or e-Aadhaar file? Open PDF Unlock & Decryptor. To permanently black out specific SSNs or paragraphs instead of locking the whole document, use the PDF Redactor & Sanitizer or ID & Aadhaar Masker. You can also sign contracts with an X.509 certificate in PDF Signer & Validator or generate standalone keys in the Password & PIN Generator.