Lock a PDF with an open password and AES-256 encryption so the file cannot be read without it. The password becomes a key on this device and neither the file nor the password is ever uploaded.
Document format work by OnlinePCApps since 2013
Each of these holds something not meant for open hands. A password decides who reads it and what they can do.
A report meant for a named few should not open for anyone who receives the file by accident. An open password encrypts the content so only a reader who holds it can see the pages at all.
A price list or a policy can be read freely and still should not be edited or lifted wholesale. A permissions setting lets it open while it holds back printing, copying and editing.
Sending a private document to a server to protect it undoes the point. The work of locking it should happen where the file already sits, not on a machine owned by someone else.
Drop a file onto the panel above or pick one from the device. It opens on the machine ready to lock, and no copy is sent out.
Enter an open password to encrypt the file, and pick whether printing, copying and editing stay allowed. A strength meter shows how firm the password is.
The encrypted file downloads beside the original. The source PDF is left untouched, so an unlocked master is kept in case the password is ever lost.
Locking a PDF turns a password into an encryption key and scrambles the content behind it. Permissions are a second, softer layer on top.
The password required to open the file. The content is encrypted against it, so without the password the pages cannot be read at all, not even previewed.
A separate owner password sets what an opened file allows, holding back printing, copying text, editing, annotations or form filling while the pages stay readable.
The lock uses 256-bit AES, the strongest scheme the PDF standard defines and the same class of encryption trusted to secure sensitive data elsewhere.
A live meter rates the password as it is typed, and a generator can build a long random one, since a weak password is the part most open to a guess.
Password protecting a PDF, encrypting it and locking it all name the same action. This tool writes the encryption into a new copy and leaves the source file untouched.
A locked PDF is a set of choices about who may open it and what they may do. These are the controls behind it.
| Setting | Type | What it decides |
|---|---|---|
| Open password | user password | The password that opens the file, also called a document open password. The content is encrypted against it, so without it the pages are unreadable and even the page count is hidden. |
| Permissions password | owner password | Sets what an opened file allows. The file opens without it, but changing the restrictions needs it. |
| Encryption | AES-256 | The strongest scheme the PDF standard defines. Older tools may default to AES-128 or RC4, which are weaker and best avoided. |
| Restrictions | permission flags | Printing, copying text, editing, annotations, form filling and document assembly, each allowed or held back. |
| Enforcement | cipher vs viewer | An open password is held by the encryption itself. Permission flags are honored by compliant viewers, not by the cipher, so a non-compliant tool can ignore them. |
| Recovery | none | There is no back door and nothing is stored, so a forgotten password cannot be recovered. The original stays as a fallback. |
| Strength | a long passphrase | A phrase of several words or sixteen characters and up resists a brute-force guess far better than a short one. |
| Compatibility | all modern readers | Acrobat, Preview, Edge, Chrome, Firefox and mobile readers all recognize and enforce AES-256 encryption. |
| Where it runs | on the device | The password becomes a key and the file is encrypted in the browser, so neither is ever uploaded. |
A Real Lock Needs the Open Password
A PDF can hold two passwords, and the difference decides how firm the lock is. An open password encrypts the content so the file cannot be read without it, and that is real protection. A permissions password alone lets anyone open the file while setting flags such as no printing, and those flags are honored only by cooperative viewers. Tools that ignore them have existed for years, so owner-only restrictions are a request rather than a wall. For content that must stay private, an open password is the one that matters. The standards below define the encryption a lock is built on.
Both encrypt a PDF with a password. The difference matters more here than elsewhere, since the whole point is to keep the file private.
| Point of comparison | This tool Locked in the browser Encrypted on the device | Hosted lockers Uploaded and encrypted on a server |
|---|---|---|
| Where the file goes | Never leaves the device | Uploaded unencrypted first |
| Where the password goes | Stays on the device | Sent to a server to apply |
| Encryption strength | AES-256 | Usually AES-256 |
| A whole folder at once | One file in the browser | Batch on their hardware |
| Automated in a workflow | By hand in a tab | Fits an API pipeline |
The bottom two rows go to the hosted services, since a batch and an automated pipeline both suit a server. The top two matter most here though. A hosted locker has to receive the file unencrypted and take in the password to apply it, while the browser keeps both on the machine, which is the safer place for a document being protected.
Encrypting a PDF turns the password into a key and scrambles the file with it. That runs on the device, so the document being protected is never handed to a server and the password that guards it is never transmitted either.
On a hosted tool the file arrives unencrypted before any lock is applied, and the password is entered on a page the server can read. Here neither happens, which for a document worth locking is the whole point.
Each of these encrypts a file. They differ in the control they offer and whether they run on the device.
Each of these keeps the file on the computer it opened on, apart from hosted lockers that ask for an upload. The tool above does the same.
A lock is only as good as the choices behind it. These three keep it firm.
The lock is only as strong as the password on it. A phrase of several words or sixteen characters and up is hard to guess, while a short common word can be brute-forced in moments.
There is no recovery for a forgotten password. Storing the password in a manager and keeping the unlocked original means a lost password never turns into a lost document.
A permissions password without an open password lets anyone read the file, and a tool that ignores the flags can lift the limits. For content that must stay private, an open password is the real lock.
The browser tool locks one document at a time, held in memory. A folder of files that all take the same password and permissions, or a set that needs decrypting and locking again with new settings, is work for the desktop edition, which reads from disk and encrypts every file without a tab open.
Point it at a directory and every PDF inside is encrypted with the same password and permissions in one pass.
A set can be decrypted with a known password and locked again with new settings, which suits rotating a password across a store of files.
A saved password and permission profile locks a batch the same way each time, which suits documents that go out on a schedule.
Free, no sign-up and no upload. The file is encrypted with AES-256 on the device and the password never leaves it.