PDF Protector

Password protection changes who can open a PDF and records what an authorized reader is expected to permit after opening. Those are different controls. An open password guards access to the document; an owner password supports printing, copying, form, annotation, assembly, and editing restrictions.

A protected PDF is useful when the file must travel through email, shared storage, or removable media without leaving its contents readable to anyone who obtains the file. The password should travel through a different channel from the document. Reusing a password or sending it beside the attachment defeats much of the benefit.

AES-256 is the normal choice for modern PDF readers. AES-128 can help with a receiving system that cannot handle the newer format, but compatibility should be tested with the actual reader. Encryption does not remove sensitive content, redact hidden information, or prove who created the document.

The source also matters. Adding encryption to an already encrypted PDF requires its existing credentials, while rewriting a digitally signed PDF can invalidate the signed byte range. A quick marker scan can catch common cases, but it is not a forensic inspection of every object in a complex PDF.

Permission flags are not digital rights management. Once authorized software has decrypted the content, a modified or non-conforming reader may disregard the requested limits. Use them as recipient guidance backed by access encryption, not as a guarantee that readable content cannot be copied.

How to Use This Tool:

Start with an unencrypted, unsigned PDF that you own or are authorized to handle, then choose access and reader restrictions for its recipient.

1. Choose Source PDF and wait for the local scan. The file must begin as a PDF, contain no detected encryption or signature markers, and be no larger than 80 MB.
2. Enter a long, unique Open password. Protection remains blocked until the displayed posture reaches Strong, which requires at least 14 characters and at least 70 estimated search-space bits.
3. Select a Permission profile. Enter a different Owner password when the profile restricts reader actions; the open-password-only profile can generate a separate owner secret locally when that field is blank.
4. Keep AES-256 and encrypted metadata unless a known receiving workflow requires AES-128 or visible document properties. Confirm Authorization for this browser session.
5. Run protection, then download only after the result reports all three checks: an encryption marker is present, the correct open password works, and a wrong password is rejected.

Interpreting Results:

Protected PDF ready means the new copy passed the three output checks in the current browser session. It does not certify every page, attachment, form, script, redaction, or signature state inside the document.

• Review the Permission map as the requested reader policy. A restricted operation is not proof that every PDF viewer will enforce it.
• Use the Protection ledger to find a blocked source, weak password, missing owner password, or failed verification without exposing either password.
• Open the downloaded copy in the recipient's actual PDF reader, test the open password, and confirm that needed workflows still work before deleting or replacing the original.

Technical Details:

PDF standard security encrypts document data with a file key and uses the open and owner passwords to control access to that key. The encryption target is AES with a 256-bit or 128-bit key. Permission choices are written as standard security-handler flags, so enforcement ultimately depends on the reader.

Formula Core

Password posture uses a search-space estimate rather than a claim about measured cracking time. Character classes contribute a nominal pool of 26 lowercase letters, 26 uppercase letters, 10 digits, and 33 symbols; the distinct-character count is used when it is larger.

Here, L is the password length in characters and P is the estimated character pool. A password is Fair at length 10 and 45 bits, Strong at length 14 and 70 bits, and High at length 18 and 95 bits. Both conditions at a level must be met. Protection requires a score of at least Strong.

Rule Core

Seven readiness gates must all pass before encryption can start. Their order matters because the first failing condition supplies the blocking status.

Transformation Core

The browser writes the selected PDF into temporary working memory, applies the chosen AES target, passwords, metadata setting, and permission flags, and creates a new byte stream. It then decrypts that output with the correct password and separately attempts decryption with a generated wrong password. The output is ready only when all three verification conditions pass.

Security and Privacy Notes:

The PDF bytes and passwords stay in the browser tab while the protection and verification work runs. The protection engine is loaded when needed from an external content host, but the document is not sent to a server for encryption.

• The initial marker scan reads at most the first and last 6 MiB of files larger than 12 MiB. An unusual PDF may hide relevant structures outside that sample.
• Authorization, passwords, and document bytes are not placed in the page URL. Closing or reloading the tab clears the in-memory secrets and file.
• The password estimate assumes independent choices from the detected character classes. Human patterns, reused phrases, leaked passwords, and predictable substitutions can make a password much weaker than the estimate.
• Keep an accessible original until the protected copy has been tested. A forgotten open password can make the document unavailable.

Worked Examples:

References:

• qpdf encryption options, qpdf documentation.
• PDF encryption and security restrictions, qpdf documentation.
• NIST SP 800-63B: Authentication and Authenticator Management, National Institute of Standards and Technology.