A PDF without protection is a fully open document. Anyone who receives it can copy its text, print unlimited copies, extract pages, or share it freely. For contracts, NDAs, financial reports, and any confidential content, that's an unacceptable risk.
This guide explains exactly how PDF passwords work, the two completely different types, what the encryption levels actually mean, and when to use each — so you can protect your documents correctly.
The Two Types of PDF Passwords
Most people don't realise that a "PDF password" can mean two entirely different things. Understanding the difference is critical to choosing the right protection level.
1. User Password (Open Password)
A user password is required to open and view the document. Without it, the PDF is encrypted and completely unreadable — the text, images, and structure are all scrambled. Anyone who receives the file must enter the password before seeing any content.
Use this when: the content is confidential and only certain people should ever see it (contracts, medical records, personal tax documents).
2. Owner Password (Permissions Password)
An owner password doesn't prevent the PDF from being opened — the document can be read without it. Instead, it restricts what the reader can do with the document. Common restrictions include:
- Prevent printing or allow only low-resolution printing
- Block copying of text and images
- Prevent editing, annotating, or filling forms
- Block extraction of pages
Use this when: the document is meant to be read but not reproduced or modified (marketing materials, reports, pricing guides).
What 128-bit vs 256-bit AES Actually Means
Modern PDFs use AES (Advanced Encryption Standard) encryption, the same standard used by governments, banks, and militaries worldwide.
| Standard | Key Length | PDF Version | Security Level |
|---|---|---|---|
| RC4 40-bit | 40 bits | PDF 1.1–1.3 | Obsolete — avoid |
| RC4 128-bit | 128 bits | PDF 1.4–1.5 | Legacy — acceptable |
| AES 128-bit | 128 bits | PDF 1.6–1.7 | Good |
| AES 256-bit | 256 bits | PDF 1.7 ext3 / 2.0 | Recommended ✓ |
For any new document, always choose AES-256. A 256-bit key has 2²⁵⁶ possible combinations — more than the number of atoms in the observable universe. No current or foreseeable computer can brute-force a strong AES-256 password.
How to Add Password Protection to a PDF
Open PDF Size Reducer Protect PDF
Navigate to PDF Size Reducer → Protect PDF. All processing happens in your browser — the document is encrypted before any operation, and your file never leaves your device.
Upload your PDF
Drag and drop your PDF onto the drop zone. The tool confirms the file name and page count.
Set your password(s)
Enter a user password (required to open), an owner password (restrictions only), or both. Tick or untick the permission checkboxes to set what recipients can do with the document.
Download the protected PDF
Click Protect PDF. Your encrypted file downloads with the suffix _protected.pdf. Test it immediately by opening it and entering the password before sending.
Protect your PDF now — free & private
Add AES-256 encryption in seconds. Your file never leaves your device.
🔒 Open Protect PDF ToolBest Practices for PDF Security
Use a password manager
Never use the same password for multiple protected documents. Generate unique, strong passwords for each sensitive PDF and store them in a password manager (1Password, Bitwarden, or your platform's built-in keychain).
Send passwords through a separate channel
If you email someone a protected PDF, don't include the password in the same email. Send it via a separate text message, phone call, or end-to-end encrypted messaging app. This way, if the email is intercepted, the PDF remains protected.
Consider time-limited access
For very sensitive documents, consider a DRM (Digital Rights Management) service that allows you to revoke access after a deadline — something a static PDF password cannot do.
Don't rely on PDF restrictions alone
As noted above, owner-password restrictions can be bypassed by some PDF tools. For truly confidential content, use a user password with AES-256 — only then is the content itself encrypted.
Frequently Asked Questions
Share this guide