PDF encryption has two genuinely different password roles, and it's worth knowing the distinction before you set one: the user password is required just to open the document at all, while the owner password controls permissions — printing, copying, editing — on a file that anyone with the user password can still open. This tool sets both, using qpdf compiled to WebAssembly to apply real AES-256 encryption, the same encryption library and cipher strength used by server-side PDF tools — running entirely on-device instead.
What actually happens when you encrypt
The PDF is loaded into qpdf's WASM build running in your browser tab, which rewrites the file's cross-reference table and object streams with AES-256 encryption applied, using your chosen user and owner passwords. If you leave the owner password blank, it defaults to the same value as the user password. Nothing about this process — the file, the passwords, or the encrypted output — is transmitted anywhere; the entire operation happens in-memory in the tab.
Why encryption alone isn't the whole story
A password-protected PDF stops someone from opening the file without the password — it doesn't protect the file once it's been opened and password-shared, and it doesn't prevent someone with legitimate access from screenshotting or printing content unless you've also set restrictive owner permissions. For genuinely sensitive documents, encryption is a strong first layer, but pairing it with careful control over who receives the password matters just as much as the cipher strength.
Common use cases
- Protecting financial statements or HR documents before sharing via email
- Adding a password layer before sending sensitive legal documents
- Securing thesis drafts or research papers shared for peer review
- Encrypting tax returns, medical records, or identity documents before storage or transfer
FAQ
What encryption does it actually use?
AES-256, applied via qpdf running as WebAssembly in your browser — not a simulated or partial encryption, the same standard used by professional server-side PDF tools.
Can I set different user and owner passwords?
Yes — enter both explicitly. If you leave the owner password field empty, it's automatically set to match the user password.
Can the recipient remove the password later?
Only with the password. Anyone who has it can use the Unlock PDF tool on InstantTools (or any PDF viewer that supports password removal) to produce an unprotected copy.
Is my PDF uploaded to a server?
No. Encryption runs entirely in your browser via qpdf compiled to WebAssembly. Your document and passwords never leave your device.
Privacy
All encryption processing runs 100% client-side. No file data, passwords, or metadata are transmitted to external servers.