Password protect a PDF
Choose a password. It is applied to a copy of your file.
How it works
- Drop your PDF in.
- Choose a password.
- Download the protected PDF.
What it does
Putting a password on a PDF means encrypting it — rewriting every string and stream in the file with a cipher. No browser can do that correctly, so unlike the other tools here, this one sends your file to our server, which runs qpdf on it and sends the result straight back. We would rather say that in the first paragraph than bury it.
What happens to your file
The upload is written to a temporary file, qpdf encrypts it, the result is returned in the same response, and both files are deleted immediately afterwards. Nothing is written to a database, no account is involved, and the response is marked so that nothing in between caches it. The password is passed to one process as an argument and is never written down anywhere — not in a log, not in a URL.
The encryption used
AES-256, which is what current PDF readers expect and what any recipient from Acrobat 9 onwards can open. Older 128-bit RC4 encryption is deliberately not offered: it is weak enough that offering it would be pretending to protect something.
Choose a password you can send separately
Encryption is only as good as the handling of the password. Sending the file and the password in the same email defeats the exercise entirely. And there is no recovery — if the password is lost the document is genuinely unreadable, by us as much as by anyone.
Doing this from your own code
POST
/api/free/protect
There is no /api/v1 route for this. There is an unauthenticated one — the same route this page uses — which takes the PDF as the request body, the password as a header, and keeps nothing.
curl -s https://docubend.com/api/free/protect \
-H "Content-Type: application/octet-stream" \
-H "X-Doc-Password: $PW" \
-H "X-Doc-Name: report.pdf" \
--data-binary @report.pdf -o report-protected.pdfconst r = await fetch("https://docubend.com/api/free/protect", {
method: "POST",
headers: { "Content-Type": "application/octet-stream",
"X-Doc-Password": encodeURIComponent(pw),
"X-Doc-Name": encodeURIComponent("report.pdf") },
body: await readFile("report.pdf"),
});
await writeFile("report-protected.pdf", Buffer.from(await r.arrayBuffer()));out = requests.post("https://docubend.com/api/free/protect",
headers={"Content-Type": "application/octet-stream",
"X-Doc-Password": pw, "X-Doc-Name": "report.pdf"},
data=open("report.pdf", "rb").read(), timeout=120).content
open("report-protected.pdf", "wb").write(out)Questions
Does my file get uploaded?
Yes, and this is the only kind of tool here that does. Browsers cannot perform real PDF encryption, so the file is sent to our server, encrypted, returned, and deleted along with the temporary copy.
Is my password stored?
No. It is passed to one process as an argument. It is never written to a log or put in a URL — the server route that handles this uses a log format that cannot record one.
What encryption is used?
AES-256. Anything from Acrobat 9 onwards can open it.
Can you recover my password if I lose it?
No. We do not have it and we do not keep the file. A lost password means an unreadable document.
How large a file can I protect?
25 MB, which is the ceiling on this route in both the browser and the server.
Can I remove the password later?
Yes, with the unlock tool, as long as you know the password. It has no way in without one — no more than anybody else does.
Next
| Tool | What it does | Runs in | Same thing, programmatically |
|---|---|---|---|
| Unlock a PDF | Take off a password, or the no-printing and no-copying restrictions. | our server | POST /api/v1/pdfs |
| Sign a PDF | Draw a signature and place it where it goes. | your browser | the document model |
| Edit a PDF | Change the words already in the PDF, in their original font. | your browser | the document model |
| Merge PDF files | Join several PDFs into one, in the order you choose. | your browser | no endpoint |