PDF encrypt / decrypt

How to use it

1. Drop one PDF on the card, paste with ⌘V / Ctrl+V, or press “Choose PDF”. The tool reads only the file trailer to decide whether it is encrypted, then shows the matching options automatically — there is no separate “detect” button and no password guessing.
2. To protect: type an open password (and confirm it). Open the “Permissions & owner password” panel to restrict printing, copying, editing, etc., set an owner password, and pick AES-256 or RC4-128. Press Encrypt, then download the new “-protected.pdf”.
3. To unlock: for an encrypted file type its open or owner password and press Decrypt; for a file with only permission restrictions, press “Remove restrictions” with no password. Verify by re-uploading the result and opening it with the password you set. Passwords are never saved or recoverable.

Example

Open password: Q3-2026
Restrict: copy off, modify off
Algorithm: AES-256

contract-protected.pdf
AES-256 (256-bit) · Print: Allowed · Copy: Not allowed · Modify: Not allowed · Comment/Form: Allowed · Assemble: Not allowed · Accessibility: Allowed · 3 pages

The output file name uses the source base name plus a fixed “-protected” / “-unlocked” suffix; the suffix is never translated so the file stays machine-readable. The PDF title inside follows the page language, but your password is never placed in the file name or the document.

Rules, limits and known issues

• Nothing is uploaded: the file is read with the File API and encrypted or decrypted in this tab. The page sends no network request, writes nothing to storage, and keeps no history — a reload starts empty.
• Passwords stay in memory for key derivation only. They are never written into a file name, the URL, storage or the log, and the password fields are never reused for output.
• Only password (standard security handler) encryption is supported. Certificate / public-key encryption (adbe.pkcs7) and signed documents are rejected, not silently weakened.
• Encrypt produces AES-256 (V=5/R=6) or RC4-128 (V=2/R=3) only. It does not produce 40-bit RC4 or AES-128. Decrypt reads the standard RC4-40/128, AES-128 and AES-256 combinations and rejects anything non-standard rather than emitting a broken file.
• Permission restrictions (/P) are honoured by readers voluntarily and can often be lifted without the owner password; they are not a way to keep a document secret. Use an open password for real confidentiality.
• A forgotten password cannot be recovered, and this tool offers no way to bypass one: an unknown open password simply does not open.
• Encrypting or decrypting does not change page content or page count, but it does not guarantee to preserve form appearances, bookmarks/outlines, attachments, layers, media, incremental-update history, or digital-signature validity.
• The output bytes always change; the encrypted file can be larger or smaller than the source, and a decrypted file expands packed object streams. There is no “size unchanged” promise.
• Older or niche readers may not open AES-256. If that happens, re-encrypt with RC4-128.
• Passwords are hashed from their UTF-8 bytes. This matches standards-compliant producers, but some legacy software that treats passwords as Latin-1 may derive a different key, so a password with non-ASCII characters may not open everywhere. This is a specification-level difference and is stated honestly.
• Limits: one PDF, 50 MB, 2,000 pages, passwords up to 127 bytes. Files or passwords over a limit are rejected rather than silently truncated. Jobs over 20 MB or 300 pages show a “may take a few seconds” hint and run on the main thread, yielding so the page stays responsive.

Related tools

Other document tools that also run entirely inside this tab.