How to password protect a PDF, and what it really protects

By the LambiPdf team · Updated 1 November 2026 · 6 min read

Adding a password to a PDF is one of the simplest ways to protect a document you send by email or store in a shared folder. It is also easy to misunderstand. Here is what a PDF password does, what it doesn’t, and how to use one well.

Encryption, not just a lock screen

When you protect a PDF with an open password, the file’s contents are encrypted. Without the password, the text and images are scrambled data, not just hidden behind a prompt. LambiPdf’s Protect tool uses AES-128 encryption, which every mainstream PDF reader can open.

Two kinds of PDF password

• Open password (user password). Needed to open and read the file. This is the one that actually keeps people out.
• Permissions. Settings that ask PDF readers not to allow printing, copying or editing. They are honored by mainstream readers, but they are restrictions on software behavior, not strong security: anyone who can open the file can view it, and some tools ignore the flags.

If the goal is “only the recipient can read this,” the open password is what matters.

Choosing a password

An encrypted PDF can be attacked offline: someone with the file can try passwords as fast as their computer allows. That makes password strength important.

• Use a long passphrase of four or five random words, or let a password manager generate one.
• Avoid names, birthdays and account numbers. They are the first guesses.
• Don’t reuse a password you use for an account.

Share the password separately

The most common mistake is sending the password in the same email as the file. If that email is forwarded, misdirected or the mailbox is compromised, the protection is gone. Send the file by email and the password by text message or phone call, or agree on it in advance.

What a password doesn’t do

• It doesn’t remove information. Anyone with the password sees everything. To remove details before sharing, redact them first.
• It doesn’t control what happens after the file is opened. A recipient can save an unprotected copy, take screenshots or print it.
• It doesn’t help if you forget it. There is no reset link for an encrypted file, so keep the password in a password manager.

Removing a password you know

Bank statements and payslips often arrive protected with your date of birth or a similar code, which is a nuisance for your own archive. If you know the password, Unlock PDF saves an unprotected copy: open the file, enter the password and save. LambiPdf cannot remove a password you don’t know, and isn’t designed to.

Encryption and decryption both run in your browser, so neither the document nor the password is sent to a server.

Questions people ask