Encrypt any PDF with AES-256, the strongest encryption the PDF standard supports. Set an open password, a permissions password, or both. Your file and your password never leave your device.
The PDF password protection tool encrypts any PDF with AES-256 encryption using a password you set. Once protected, the PDF requires the correct password to open in any PDF viewer. You can also restrict printing and copying independently of the open password. Encryption runs entirely in your browser using WebAssembly — your file and password are never sent to any server. Use it to protect sensitive documents before emailing or uploading them to cloud storage.
🔒 Drop your PDF here
or click to browse your computerℹ️ Work from a copy of your file and keep the original safe. Check the result before you use it.
Restrictions require a permissions password to be effective. Without an owner password, any PDF editor can ignore them.
Encryption is applied using pdf-lib running locally in your browser. Your PDF and your password never travel to any server. The encryption key is derived and applied entirely on your device.
Open password (user password): Required to open the PDF at all. Anyone without this password will see a password prompt and cannot view the content. Use this when the document should be completely inaccessible to unauthorised recipients.
Permissions password (owner password): Allows the PDF to be opened but restricts what the recipient can do. Only the person who knows the owner password can change or remove the restrictions. Use this when you want recipients to read the document but not print it, copy text from it, or edit it.
Using both together: You can set different passwords for each. The open password is what recipients need to view the document. The permissions password is what you (or an authorised administrator) use to modify or remove the restrictions later.
AES-256 is the strongest encryption the PDF standard supports. Every file you protect with RapidTools uses it, so there is no weaker setting to pick by mistake.
It is the same encryption standard that banks and governments use to protect sensitive information.
It works in all modern PDF readers, including Adobe Acrobat, Chrome, Edge, Firefox, and Mac Preview. The person you send the file to only needs the password to open it.
Different regulatory frameworks impose different minimum encryption standards. The table below maps each framework to its specific PDF security requirements, the minimum password complexity expected, and whether AES-256 encryption satisfies the obligation or whether additional controls (access logging, MFA) are also needed.
| Framework | Key Requirement | Min Password | AES-256 Sufficient? | Notes |
|---|---|---|---|---|
| HIPAA Required |
45 CFR §164.312(a)(2)(iv) — encryption and decryption of ePHI. HHS guidance endorses NIST-approved algorithms. | 8+ chars recommended; no HHS minimum specified | Yes — AES-256 is NIST-approved (FIPS 197) | Must also implement audit controls (§164.312(b)) and access logs. Encryption alone does not equal HIPAA compliance. |
| PCI-DSS v4.0 Required |
Requirement 3.5.1 — primary account numbers must be encrypted using strong cryptography. Req 8.3.6 — passwords ≥ 12 chars since v4.0 (March 2025). | 12+ characters (up from 7 in v3.2) | Yes — AES-256 qualifies as strong cryptography | PCI-DSS specifically targets cardholder data. PDFs containing PANs, CVVs, or card numbers must use strong cryptography such as AES-256. |
| GDPR Article 32 Recommended |
"Appropriate technical measures" including encryption of personal data. No specific algorithm mandated — proportional to risk. | No statutory minimum; risk-proportionate | Yes — AES-256 meets the level recommended for high-risk data | Data processors should document their encryption choice as part of the Article 30 records of processing activities. AES-256 is defensible for both standard and high-risk personal data. |
| SOC 2 Type II Recommended |
CC6.1 (logical access security) and CC6.7 (transmission encryption). Auditors expect encryption of sensitive data at rest and in transit. | Defined by organization's own policy | Yes — auditors accept AES-256 for document encryption | Password-protected PDFs count toward CC6.1 controls. Must be documented in security policy. Pair with access control and logging. |
| FINRA Rule 4370 Recommended |
Business continuity and customer records. SEC Rule 17a-4 requires encryption for electronic storage of broker-dealer records. | Not specified; industry standard expected | Yes | Encrypted PDFs for trade confirmations, account statements, and customer communications are common implementation. WORM storage requirements apply separately. |
| FERPA Recommended |
Protects student education records. Encryption is not mandated but is the recognised safeguard against unintended disclosure, particularly for records sent electronically. | Not specified | Yes | FERPA-covered institutions commonly use password-protected PDFs for transcripts, grade reports, and disciplinary records shared with third parties. |
PDF permissions flags are defined in the PDF specification (ISO 32000) and enforced by PDF reader software. Understanding exactly what each flag restricts — and what it does not — is important when deciding which restrictions to apply.
| Restriction | What It Prevents | What It Does Not Prevent | Bypass Risk |
|---|---|---|---|
| Prevent Printing | Print dialog is disabled in compliant readers. High-resolution printing is blocked; low-resolution printing may also be blocked depending on the flag set. | Screenshots or screen captures of each page. Screen-to-PDF tools (e.g. Microsoft Print to PDF, macOS PDF Print). Any method that renders the screen rather than calling the print API. | Medium |
| Prevent Copying Text | Text selection and clipboard copy is disabled in compliant readers. Copy-paste of text from the document is blocked. | OCR tools run against exported images of the pages. Screenshots followed by OCR. Retyping visible text. Any reader that ignores permissions flags. | High |
| Prevent Editing | Document modification, form field editing, annotation, page insertion/deletion, and document assembly are all disabled in compliant readers. The document is effectively read-only. | Opening the file in a non-compliant editor. Extracting pages to a new PDF. Readers that strip permissions during rendering. | Medium |
| No owner password set | N/A — restrictions are still written to the file. | Any PDF editor (including free ones like PDF24, LibreOffice, PDFsam) can open a restrictions-only PDF without an owner password and save a copy with all restrictions removed. Permissions with no owner password provide negligible protection. | Very High |
Rapid