How strong is the encryption, really?

AES-256 itself is not brute-forceable in any realistic timeframe. The weak point is always the password: short or common passwords fall to dictionary attacks in minutes regardless of the algorithm. A four-or-five-word passphrase puts the file out of practical reach.

What happens if I forget the password?

The contents are unrecoverable — there is no backdoor, reset, or recovery service, by design. Store the password in a password manager before you distribute the file, and keep an unencrypted copy somewhere safe if appropriate.

Can the recipient remove the password?

Yes — anyone who knows the password can decrypt the file, for instance with the Unlock PDF tool, and save an unprotected copy. Encryption protects the file from people without the password; it can't control what legitimate recipients do afterwards.

Can I set separate restrictions like no-printing or no-copying?

No — this tool applies one open password and leaves usage permissions unrestricted for anyone who has it. Permission flags offer weak protection in practice (most non-Adobe software ignores them), so the focus here is the protection that actually holds: encryption.

Will very old PDF readers open AES-256 files?

Readers from roughly the last decade handle it without issue. Genuinely ancient viewers may not support AES-256 — if a recipient reports they can't open the file, an updated reader is the fix.

Lock PDF

Add password protection to your PDF files.

Your PDF is encrypted with AES-256 directly in your browser — it never leaves your device. Keep your password safe: it cannot be recovered.

Drop PDF files here or browse

Max 100MB per file

About Lock PDF (Add Password)

Adding a password to a PDF means the file cannot be opened by anyone who doesn't know it — not by your email provider, not by whoever finds a lost USB stick, not by someone who gets forwarded the message by mistake. The contents are encrypted, not merely hidden.

Convertora encrypts with AES-256, the strongest encryption defined by the PDF specification and the same family of algorithm used for classified material. The encryption is computed in your browser via a specialized PDF library; the password and the document never leave your device, which makes the tool itself a non-issue in your threat model.

One design choice worth knowing: this tool sets an open password — protection against reading the file. It doesn't configure granular permission flags (no-printing, no-copying), which are widely ignored by PDF software anyway and provide little real protection. Someone who can open the document can use it; someone without the password can't even see page one.

How to use it

1Upload the PDF you want to protect (up to 100 MB).
2Choose a password. A long passphrase of several words is far stronger than a short string of symbols — length is what defeats guessing attacks.
3Click Lock. The file is encrypted with AES-256 in your browser.
4Download the protected copy, saved with a -protected suffix. Opening it in any reader now prompts for the password.
5Share the password through a different channel than the file — if both travel in the same email, the lock protects nothing.

What you get

AES-256 encryption — the strongest standard PDF encryption available.
Entirely client-side: the password and document never leave your browser.
Output opens in all modern PDF readers (Adobe, Foxit, Preview, browser viewers) after the password prompt.
No account, no upload, no copy of your file retained anywhere.

Common use cases

Emailing payroll, medical, or legal documents that shouldn't be readable if the message is forwarded or intercepted.
Protecting files shared through cloud links, where anyone with the URL could otherwise open them.
Securing documents on a USB drive or shared computer.
Meeting a client's or regulator's requirement that documents in transit be encrypted.

Frequently asked questions

Tips

Send the password by a different channel than the document — text it if you emailed the file.
Flatten filled forms (Flatten PDF) before locking, so the values are final inside the encrypted copy.

100% private — runs in your browser

Convertora processes everything on your device using JavaScript and WebAssembly. Files never leave your browser, are never uploaded to a server, and are never seen by us or anyone else. The moment you close the tab, the data is gone — there is no temporary cloud copy, no log entry, no retained backup.

Because the work happens locally, processing speed depends on your device — but there are no rate limits, no daily caps, and no file size restrictions beyond what your browser can handle in memory. No signup, no account, no payment. The tool works the same in incognito mode, on a corporate network, or after the page has loaded once, even with the network disconnected.