How to Password Protect a PDF (and Choose a Password That Holds)

To password-protect a PDF properly, set an open password, the one a reader must type before any page appears, and make it long: a passphrase of three or four random words beats a short string of symbols. Permission restrictions such as "no printing" are a polite request to the reader's software, not real protection.

Most guides stop at "click Protect and type a password". The part that decides whether your payslip or medical report is actually safe comes after that: which kind of password you set, how long it is, and how you get it to the recipient. This guide covers all three, with the current advice from the US National Institute of Standards and Technology (NIST) and the UK's National Cyber Security Centre (NCSC).

Key takeaways

• A PDF can have two passwords. The open password encrypts the file; the permissions password only asks viewers to block printing, copying or editing.
• Adobe warns that if third-party products do not support permission settings, recipients "are able to bypass some or all of the restrictions you set" (Adobe).
• NIST's 2025 guidance asks for passwords of at least 15 characters when a password is the only factor, and drops composition rules such as requiring a symbol (NIST SP 800-63B-4).
• The NCSC recommends combining three random words (NCSC).
• Send the password by a different route from the file, and keep it somewhere safe: a forgotten PDF password cannot be reset.

Open password versus permissions password

Adobe's help page describes the two clearly. "A Document Open password (also known as a user password) requires a user to type a password to open the PDF." A "permissions password (also known as a master password) requires a password to change permission settings", and "Recipients don't need a password to open the document" (Adobe).

The difference matters. An open password encrypts the content, so without it the pages are unreadable. A permissions password leaves the document readable and relies on the viewer to grey out the print or copy buttons. Adobe's own wording is the best warning: "All Adobe products enforce the restrictions set by the permissions password. However, if third-party products do not support these settings, document recipients are able to bypass some or all of the restrictions you set."

Siliph's own tools show how thin that layer is. Unlock PDF removes owner-only restrictions from a PDF that opens freely without asking for any password, because there is nothing secret to decrypt. Treat permissions as a convenience for honest recipients, and the open password as the real lock.

How encryption strength has changed

PDF encryption has improved over the years. Adobe's own options show the history: "Acrobat 6.0 And Later (PDF 1.5) encrypts the document using 128-bit RC4", while "Acrobat X And Later (PDF 1.7) encrypts the document using 256-bit AES" (Adobe). The PDF 2.0 standard goes further and states that "Use of security handler revisions 1, 2, 3, 4 and 5 is deprecated in PDF 2.0", leaving revision 6, which uses AES-256 (ISO 32000-2, via PDF Association).

For you, the practical point is simple. Modern encryption is strong enough that attackers do not try to break it; they try to guess the password. Anyone holding a copy of your file can try guesses as fast as their computer allows, with no lockout after ten wrong attempts the way a website login has. That makes the password's length the part you control.

How to choose a strong PDF password

What the guidance says

NIST's current authentication guideline, SP 800-63B-4 (final, July 2025), sets out rules for systems that check passwords. Several translate directly to choosing your own (NIST):

• Passwords used as the only factor should be "a minimum of 15 characters in length".
• Systems "SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types)", because forced symbols push people towards predictable patterns like Password1!.
• Candidate passwords should be compared "against a blocklist that contains known commonly used, expected, or compromised passwords."
• Long passwords should be allowed, with a maximum of "at least 64 characters".

The UK NCSC puts it in one line: "Combine three random words to create a password that's 'long enough and strong enough'" (NCSC).

A practical recipe

1. Pick three or four genuinely random words, not a phrase from a song or the document's subject. "lantern copper meadow" is better than "salary october 2026".
2. Check the length. Three or four ordinary words easily pass 15 characters.
3. Make sure the recipient can type it on a phone keyboard. Avoid characters that are hard to find on mobile.
4. Never reuse the password from your email or bank account.
5. Store it in a password manager, or somewhere you will find it again, before you send the file.

How to password-protect a PDF with Siliph

Siliph's Protect PDF is free with no account and handles up to 50 files per task, each up to 200 MB.

1. Open Protect PDF and upload the PDF.
2. Type your password in the Password field and again under Confirm password. The two must match.
3. Under Permissions, tick only what readers may still do once the file is open: Allow printing, Allow copying text, Allow editing or Allow commenting. Leave a box clear to block that action.
4. Click Protect and download the locked file.
5. Open it yourself once to confirm the password works before you send it.

A few things to do before locking: black out account numbers with Redact PDF, because a password hides the whole file but not a line inside it from someone who has the password. Strip the author name and other properties with Remove Metadata, which works in your browser. If the copy might be photographed or forwarded, a name stamp from Watermark PDF shows where it came from.

Protect PDF runs on Siliph's servers. Your file travels over an encrypted HTTPS connection, the password is applied automatically with no human access, and both the upload and the locked copy are deleted within 2 hours.

Sending the password safely

Emailing the password in the same message as the file defeats the purpose. Anyone who gets into that inbox, or receives a forwarded copy, has both. Better options:

• Send the file by email and the password by text message or phone call.
• Agree a password in person for files you will exchange regularly.
• Use a password manager's secure sharing feature if you both have one.

Some organisations set predictable passwords, such as a date of birth plus part of a name. That is convenient but weak, because the details are often easy to find. For your own files, choose random words instead.

Other ways to password-protect a PDF

• Mac Preview: choose File > Export, click Permissions, select "Require Password To Open Document", enter the password, set an owner password, then Apply and Save (Apple).
• Microsoft Word: when saving as PDF, open Options and select "Encrypt the document with a password"; Word then asks you to type and re-enter it (Microsoft Support).
• Adobe Acrobat: paid Acrobat can set passwords and choose the encryption level. The free Reader cannot: Adobe says security settings "cannot be set in Reader" (Adobe Reader FAQ).

Frequently asked questions

What is the difference between a user password and an owner password?

The user, or open, password must be typed before the PDF displays, and it encrypts the content. The owner, or permissions, password controls printing, copying and editing, and the file opens without it, so those limits depend on the reader's software honouring them.

How long should a PDF password be?

At least 15 characters. NIST's 2025 guidance uses 15 as the minimum when a password is the only protection, and three or four random words reach that length while staying easy to type.

Can I recover a PDF if I forget the password?

No. A properly encrypted PDF has no reset option. Keep the password in a password manager and an unprotected original in a safe place before you share the locked copy.

Can someone remove a PDF password?

Anyone who knows the open password can save an unlocked copy. Without it, the file cannot be opened. Permission restrictions are much weaker and can be removed without a password, so do not rely on them alone.

Will a password-protected PDF open on a phone?

Yes. The protection is part of the PDF format, so Acrobat Reader, Preview, Chrome, Edge and phone PDF apps ask for the password and then show the file normally.