How to Password-Protect a PDF with AES-256 Encryption

A PDF can be beautifully organized and still be unsafe to send. Tax forms, payroll records, contracts, medical paperwork, and identity documents often travel as ordinary email attachments that anyone with access to the inbox can open. Password protection adds a cryptographic gate: the file contents stay unreadable until the recipient supplies the password.

Novus Protect PDF applies AES-256 encryption entirely in your browser. You choose an open password, a separate owner password, and the viewer permissions, then the tool verifies the protected output before downloading it. Neither the document nor either password is uploaded.

Encryption transforms the readable objects inside the PDF into data that cannot be interpreted without the key derived from a valid password. AES-256 refers to the Advanced Encryption Standard — published by NIST as FIPS 197 — using a 256-bit key. In a modern PDF, that is real cryptographic protection, not a hidden flag or a filename trick. A person who intercepts the file should not be able to read its pages simply by opening it in another viewer.

The open password is the one a recipient types to view the document. It is the barrier protecting the contents. The owner password gives full control over the PDF and is used to change or remove protection later. Novus requires the two passwords to be different and at least eight characters long so the document is not configured with one weak secret doing every job.

Give recipients only the open password unless they genuinely need administrative control. Keep the owner password in a password manager with the unencrypted original. If the owner secret is lost, Novus cannot retrieve it—there is no account record, recovery database, or server-side copy by design.

1. 1

   Finish every edit first

   Complete filling, signing, merging, organizing, and numbering before encryption. Protecting the final copy avoids unnecessary unlock-and-reprotect cycles.

2. 2

   Open Protect PDF

   Go to the Protect tool and choose the finished PDF. Confirm the preview and page count show the right document.

3. 3

   Create the open password

   Use a long, unique passphrase the recipient can enter accurately. Avoid names, dates, addresses, or a password reused on another account.

4. 4

   Create the owner password

   Choose a different strong passphrase and store it privately. This is the credential for full access and later removal of protection.

5. 5

   Choose permissions

   Decide whether viewers may print, copy, modify, fill forms, or add annotations. Match these options to the recipient's real task.

6. 6

   Protect, download, and test

   Run the tool, save the verified output, and open it yourself. Confirm the password prompt appears and the open password works before sending the file.

PDF permissions tell a compliant viewer what someone who opened the file may do: print, copy text, modify pages, fill fields, or add annotations. They are useful guardrails. A contract sent for reading may disable modification; a form sent for completion must keep filling and annotation available; a print shop obviously needs printing permission.

Those permission switches are not the same security boundary as the open password. Encryption prevents someone without a password from reading the content. Permission flags are rules that PDF viewers are expected to enforce after the file is open, and not every piece of software treats them as unbreakable DRM. Use them to express and reinforce intended use, not as a substitute for access control.

• Allow printing when the recipient needs a paper copy or when the file is going to a print service.
• Allow copying when the recipient needs reference numbers, addresses, or quotations from the document.
• Allow modification only when the recipient should be able to restructure or edit the PDF.
• Allow form filling and annotation for a document that still needs answers, a signature, comments, or highlights.

Length is the most useful property. A passphrase made from several unrelated words is usually stronger and easier to enter than a short word decorated with one capital letter and an exclamation mark. Do not put the recipient's name, the document title, or the current year in the password; anyone who has the attachment already has the context needed to guess those.

Use a password manager to generate and store the owner password. For a one-time open password, choose a long passphrase and transmit it accurately. If multiple recipients do not need to share access, creating separate protected copies with different open passwords limits the impact of one password being forwarded.

Encryption loses much of its value if the attachment and password sit in the same email. Someone who gains access to that message gets both pieces. Send the PDF by email and the password by text, phone, a secure chat, or another agreed channel. Avoid naming the password message so explicitly that it becomes effortless to match after an account compromise.

Password protection controls who can open a document. It does not remove sensitive information from inside it. If a Social Security number or account detail should not be shared with the recipient at all, remove it through a real redaction workflow before encrypting the final copy.

Encryption also does not prove who created or approved the file. A certificate-based digital signature provides identity and tamper evidence; a drawn signature shows signing intent; a password controls access. These features can appear in the same workflow, but they solve different problems.

When you are authorized to change the file, Unlock PDF can remove its protection locally with a valid credential. To change a password, unlock the working copy and run Protect PDF again with new open and owner passwords. Keep a securely stored unencrypted original so ordinary edits never depend on remembering an old recipient password.