Secure

Password-protect a PDF, and see it proved

Encrypt it with a password.

On this device

Choose a password

The password stays in this tab and Steady PDF cannot reset it. Keep a separate copy and use a long passphrase: weak passwords can still be guessed.

    Opened on this device · never transmitted

    What this tool does, exactly

    The tool writes AES-128 under the PDF standard security handler at revision 4. It then re-opens the finished bytes: the no-password attempt must fail, the supplied password must work, and sampled page content must not remain in clear text.

    What it is
    AES-128 in CBC mode under the PDF standard security handler at revision 4. The self-check confirms the finished bytes declare that mode, omit sampled clear-text content, refuse the no-password open and open with the supplied password.
    The one thing to understand
    The protection still depends on the password. Revision 4 uses legacy password derivation, so a short or obvious password can be found by guessing. That is why an empty password, anything under six characters and short runs of digits are refused outright.
    What it is not
    AES-256. This tool does not implement revision 6 protection, so use a current desktop PDF tool if AES-256 is a requirement. The interface states that limit before you create a file.
    What it proves
    Before you are offered anything, the finished file is re-opened from its own bytes: it must declare encryption, it must be refused with no password, it must open with yours, it must still have every page, and a run of the original page content must be absent from the file. If any of the five fails, there is no download.
    What it cannot do
    Reset or return the password. Nothing about the file or password is sent to Steady PDF, so there is no server copy or account recovery path here. Keep a separate copy before you close this tab; guessing a weak password is possible, but it is not a reset service.

    About this tool

    Is the file really encrypted, or just marked read-only?

    The finished bytes declare AES-128 revision 4 protection and sampled clear-text content is absent. The self-check then opens the file twice: the no-password attempt must fail and the supplied-password attempt must succeed. That proves what this tool wrote; it does not make a weak password resistant to guessing.

    Is this AES-256?

    No. This tool writes AES-128 under revision 4 and does not implement revision 6 AES-256 protection. If AES-256 is a requirement, use a current desktop PDF tool and verify its reported encryption mode.

    Why does it refuse my password?

    Because the encryption is only as strong as the password. Revision 4's key derivation is 50 rounds of MD5, which is cheap to run over a guess list, so a short password is the whole attack. Empty passwords, anything under six characters and short runs of digits are refused; a passphrase of several words is far stronger than a clever short one.

    What happens if I forget the password?

    Steady PDF cannot reset or return it: the password stays in this tab while the tool runs, and no server copy or account recovery path exists here. Keep a separate copy before closing the page. A weak password may still be guessed; that is an attack on password strength, not a recovery feature.

    What do the permission settings do?

    They record what a reader is allowed to do once the file is open: copying text, printing, changing it. They are enforced by the reader rather than by mathematics, so treat them as an instruction to well-behaved software, not as a guarantee. Opening is cryptographically gated, but that boundary is still only as strong as the chosen password; weak passwords may be guessed.

    Can I protect a file that already has a password?

    Not directly — this tool does not ask for an existing password. Remove the old one with the unlock tool on this site, then protect the copy here with the password you want.

    More secure tools · All 52 · How they work