How to Password Protect a PDF: AES Encryption, Browser Tools, and What Actually Works

Password-protecting a PDF is often presented as a simple security measure, but the reality is more nuanced. Not all "PDF protection" is equally strong — and understanding the difference between metadata protection, open-password encryption, and permissions passwords is essential to choosing the right method for your use case.

The Three Types of PDF Security

1. Open Password (User Password)

This requires a password to open the PDF at all. Without the password, the file appears encrypted and cannot be read. This is implemented using AES-128 or AES-256 encryption in compliant PDF tools. It's the most meaningful form of PDF protection for controlling who can access a document.

2. Permissions Password (Owner Password)

This restricts what an authenticated user can do with the document — printing, copying text, editing forms, extracting pages. The file can still be opened without a password; the permissions password only prevents certain operations in compliant PDF viewers. Technically sophisticated users can bypass permissions restrictions.

3. Metadata Security Flags

Some tools add metadata indicating a document is "protected" or set security flags in the document dictionary. Without actual encryption, this is purely advisory — a well-formed PDF viewer may respect these flags, but they provide no actual access control. Folium's browser-based Protect PDF tool operates at this level (because true AES encryption requires server-side cryptographic operations that browsers cannot perform securely).

Method 1: Browser-Based Protection (Metadata Level)

Folium's Protect PDF tool adds security metadata and protection flags to your PDF. This is appropriate for:

• Marking a document as intended-to-be-restricted before applying full encryption in a desktop tool
• Setting up metadata that signals protected status to compliant PDF viewers
• Casual deterrence for non-sensitive documents

We're transparent that this is not AES encryption. For sensitive documents requiring true access control, use a desktop tool as described below.

Method 2: Adobe Acrobat — Full AES-256 Encryption

Acrobat Pro provides the gold standard for PDF password protection, implementing AES-256 encryption (the same encryption standard used by governments and banks).

1. Open your PDF in Adobe Acrobat Pro (not Reader).
2. Go to File → Properties and click the Security tab, or use Tools → Protect → Encrypt with Password.
3. Check Require a password to open the document and enter your password. Use a strong password: minimum 12 characters, mixed case, numbers, and symbols.
4. Select AES 256-bit encryption (highest security option, compatible with Acrobat 9+).
5. Click OK, confirm your password, and save the file.

Method 3: LibreOffice (Free, Full Encryption)

LibreOffice is a free, open-source office suite that can export PDF files with full AES-256 password encryption — no Acrobat subscription required.

1. Open your document (or PDF) in LibreOffice.
2. Go to File → Export as PDF.
3. Click the Security tab in the PDF Export dialog.
4. Click Set open password and enter your password. Optionally set a permissions password for printing/editing restrictions.
5. Click Export to create the password-protected PDF.

What Makes a Strong PDF Password?

The strength of AES-256 encryption depends entirely on your password. A weak password makes AES-256 trivially breakable with GPU brute-force attacks.

Password Type	Example	Time to Crack (GPU)	Verdict
Short common word	hello	Milliseconds	Never use
6 random lowercase	kxmpvw	Minutes	Too short
Date + word	Jan2025contract	Hours–Days	Weak
12+ mixed characters	F7#mKx2@rLpQ	Centuries	Good
4-word passphrase	correct-horse-battery-staple	Millenia	Excellent

When Is PDF Protection Actually Sufficient?

PDF encryption is appropriate for:

• Sending sensitive documents over email where the password is shared through a separate channel (SMS, phone)
• Storing sensitive archived documents where the file itself is accessible (shared drive) but content should be restricted
• Complying with regulatory requirements for document security

PDF encryption is not sufficient for:

• Documents that must never be seen by unauthorised parties — for these, use secure document management platforms with access logging
• Long-term archival where the password might be lost — maintain unencrypted originals in a secure location separately