How to Password Protect a PDF on Windows

Protect a PDF whenever it could end up somewhere you don't control: an email thread, a shared drive, a USB stick or a laptop that might get lost.

Two kinds of protection are easy to mix up. A password to open encrypts the whole document, so without the password it's unreadable. Permissions for printing, copying and editing are rules that PDF apps are asked to follow once the file is open. Standard apps respect them, but it's the open password that keeps the content private.

No. Windows 11 has no built-in tool that puts a password on a PDF. Microsoft Edge, the default PDF reader, can highlight, draw, add text and fill in forms, but it has no password or encryption setting. Microsoft Print to PDF, the virtual printer, writes a new PDF from anything you print, again without a password option.

The protections Windows does have don't travel with the file. Compress to > ZIP File in File Explorer makes a ZIP without a password, and EFS encryption (Encrypt contents to secure data in a file's advanced properties, on Windows Pro) protects the file on your own PC, not the copy you email or upload.

Word, which comes with Microsoft 365 or Office rather than with Windows, can save a document as a password-protected PDF: choose File > Save As, set Save as type to PDF, click Options, select Encrypt the document with a password, click OK and type the password twice.

That suits documents you write in Word. An existing PDF has to be opened in Word first, which converts it into an editable document; the layout often shifts and fonts are replaced, so the protected copy may not look like the original. Word also sets only a password to open, with no settings for printing, copying or editing, and it protects one document at a time.

File Acture's Protect PDF encrypts each PDF with AES-256, the strongest encryption the PDF standard defines, and saves a protected copy. It works on the PDF itself, so nothing is converted or reprinted and the pages look exactly as they did.

Type the password in Password and again in Confirm password, then set the Permissions: Allow printing and Allow copying text and images are on by default, and Allow editing is off. Every PDF in the run gets the same password, which makes it easy to lock a month of invoices or a set of reports in one go.

The document's title, author and other metadata are encrypted too, and screen readers can still read the text once the file is open, as the PDF 2.0 standard requires. The owner password that guards the permissions is random and never shown, so nobody can lift the restrictions with a password; to change them, protect the original again. Each copy is saved with “-protected” in its name, and the originals stay as they were.

Encryption is only as strong as the password and the way you share it.

• Use a long passphrase. Four or five random words are easier to type and harder to guess than a short code.
• Send the password separately, for example by text message when the PDF goes by email.
• Keep it safe. AES-256 has no back door, so a forgotten password means a locked file for good.
• Already protected? Remove the old password first with Unlock PDF, then protect the copy with the new one.
• Compress first. File Acture compresses unlocked PDFs, so shrink the file with Compress PDF before you protect it.
• Many different files? A password-protected ZIP keeps documents, photos and spreadsheets together under one password.

Uploading a private PDF to a website so it can be locked defeats the purpose: the unprotected file has already left your hands. File Acture encrypts on your PC, and nothing about the file itself is sent anywhere; the free version needs an internet connection only to count its runs. It includes 3 runs of up to 5 PDFs on each PC, and Pro is a one-time purchase without those limits; see pricing.

Curious what happens when a website does this for you instead? What uploading really means.