The short answer
Password Protect PDF encrypts the file with AES-256 in your browser. Send the password by a different channel from the document, and check the file for metadata and hidden data first — encryption protects the contents, not what is written around them.
Runs in this tab, on qpdf (WebAssembly), pdf.js and pdf-lib, so your file is read from your own device and never sent anywhere. Check it yourself
Step by step
- Clean the file first Clear the author name and editing dates, and redact anything that must not be read even by the recipient.
- Encrypt with AES-256 Type a passphrase of a few unrelated words rather than a short clever password. The cipher is only as strong as what you choose.
- Decide what the recipient may do Permission flags for printing and copying say what you expect. They are honored by convention, so treat them as a signal rather than a lock.
- Send the password another way A text message, a call, or a secret you already share. Not the same email — that protects nothing.
- Keep the unencrypted original The protected copy is for sending. You do not want your only copy behind a password in two years.
Questions
Is AES-256 strong enough for confidential documents?
Yes. The weak points are the password and how you share it, not the algorithm.
Can I stop the recipient forwarding it?
No. Once they can open it they can forward both file and password. Only a managed document platform can revoke access.
Will it open on a phone?
Yes. AES-256 is supported by every modern reader, including iOS and Android.
More in PDF Security & Privacy Tools .