How to Password Protect a PDF on Mac

Protect a PDF whenever it could end up somewhere you don't control: an email thread, a shared drive, a USB stick or a laptop that might get lost.

Two kinds of protection are easy to mix up. A password to open encrypts the whole document, so without the password it's unreadable. Permissions for printing, copying and editing are rules that PDF apps are asked to follow once the file is open. Standard apps respect them, but it's the open password that keeps the content private.

Preview can lock a PDF from its export sheet: choose File > Export, click Permissions, select Require Password To Open Document, type the password twice, set an owner password for the permission settings, click Apply and save.

It's free and fine for the odd file, with two limits. It works on one PDF at a time, and it relies on Apple's PDF engine, whose encryption keys are at most 128 bits, while current PDF software supports AES-256. To change or remove the password later, open the file and choose File > Edit Permissions.

File Acture's Protect PDF encrypts each PDF with AES-256, the strongest encryption the PDF standard defines, and saves a protected copy.

Type the password in Password and again in Confirm password, then set the Permissions: Allow printing and Allow copying text and images are on by default, and Allow editing is off. Every PDF in the run gets the same password, which makes it easy to lock a month of invoices or a set of reports in one go.

The document's title, author and other metadata are encrypted too, and screen readers can still read the text once the file is open, as the PDF 2.0 standard requires. The owner password that guards the permissions is random and never shown, so nobody can lift the restrictions with a password; to change them, protect the original again. Each copy is saved with “-protected” in its name, and the originals stay as they were.

Encryption is only as strong as the password and the way you share it.

• Use a long passphrase. Four or five random words are easier to type and harder to guess than a short code.
• Send the password separately, for example by text message when the PDF goes by email.
• Keep it safe. AES-256 has no back door, so a forgotten password means a locked file for good.
• Already protected? Remove the old password first with Unlock PDF, then protect the copy with the new one.
• Compress first. File Acture compresses unlocked PDFs, so shrink the file with Compress PDF before you protect it.
• Many different files? A password-protected ZIP keeps documents, photos and spreadsheets together under one password.

Uploading a private PDF to a website so it can be locked defeats the purpose: the unprotected file has already left your hands. File Acture encrypts on your Mac, and nothing about the file itself is sent anywhere. Pro even works without an internet connection, going online only now and then to renew its license. The free version includes 3 runs of up to 5 PDFs on each Mac; see pricing for Pro.