QuickMergeAdd Password Protection to a PDF
Short answer: To password-protect a PDF, choose a strong password and download the encrypted copy. QuickMerge applies AES-256 encryption in your browser, so neither the file nor password is uploaded.
Add a password with real AES-256 encryption — the same qpdf engine used on servers, compiled to WebAssembly and running in your browser. Your file and your password never leave this device.
How do I password-protect a PDF?
Drag & drop here
or click to browse
Genuine AES-256 Encryption, Entirely In Your Browser
Most online “protect PDF” tools ask you to upload the document and type the password on their servers — exactly the two things that should never leave your machine. This tool runs qpdf, the industry-standard open-source PDF transformation engine, compiled to WebAssembly and executing inside your browser. Your PDF is encrypted with 256-bit AES — the modern PDF 2.0 standard — and the password is applied on your own device.
The result opens in any PDF reader (Adobe Reader, Preview, browsers) after entering the password. Everything runs on your device via open-source browser libraries — your file is never uploaded. You can verify it yourself.
Next steps
Before this step
- compress before encrypting — compression works on the unencrypted file.
- remove sensitive content first — a password protects the file, not the information inside it.
Related tools
- remove a password you already know — the reverse of this operation.
Browse all PDF tools, or see every QuickMerge tool.
Wondering how big a file this can take? We measured it: see Protect PDF on the measured limits page, or the browser support matrix.
Frequently Asked Questions
Real encryption. The document content is encrypted with AES-256 by qpdf, the same engine used in server pipelines worldwide. Without the password the content is cryptographically unreadable — not hidden, encrypted.
There is no recovery, no backdoor, and we never see the password — it exists only in your browser's memory during encryption. Store it in a password manager.
Yes — AES-256 is the standard PDF encryption; Adobe Reader, macOS Preview, Chrome, Firefox, and mobile readers all prompt for the password and open it normally.
Your browser downloads the qpdf WebAssembly engine (about 1.2 MB) on first use. After that it is cached and encryption is nearly instant. Your file itself never travels anywhere.
It is the same AES-256 standard, applied by qpdf. A file protected here opens with the password in Acrobat, Preview, Chrome and any other standards-compliant reader.
The document cannot be opened, by you or anyone else. Nothing was uploaded, so there is no copy to recover and no support route that can bypass it. Store the password before sharing the file.
Yes, if you know it — the unlock tool decrypts a PDF you can already open. It cannot break a password you do not have.
Those permission flags can be set, but they depend on the reader honouring them and many do not. Treat them as a statement of intent; the open password is the real control.
Here, yes, and for a specific reason: the file and the password are processed on your device and never transmitted. You can confirm that yourself with the method on the proof page.
Load the document, set a password, and download the encrypted copy. It uses AES-256 through qpdf, so the file opens with that password in Acrobat, Preview, Chrome or any standards-compliant reader. Record the password before you send the file — there is no way to recover it.
Windows ships nothing that protects an existing PDF. Word can export one with a password if the document began in Word, but for a PDF you already have the options are installing software or using a page like this — which does it in the browser without the file being uploaded.
Preview can, through File → Export as PDF and the Encrypt checkbox, though the interface moves between macOS versions. This page works the same way on macOS as anywhere else, and applies the same AES-256 standard.
The document cannot be opened, by you or by anyone. Nothing was uploaded, so there is no copy to recover and no support route around it. That is what real encryption means, and it is why the password should be recorded somewhere durable first.
No. A password in the same thread as the file it protects adds almost nothing. Send it by a different channel — a call or a message on another service — so that compromising one is not enough.
Yes, if you know it: the unlock tool decrypts a PDF you can already open. It cannot break a password you do not have, and nothing honest can.
A strong password is only useful if it travels separately
Password protection encrypts the PDF download. Sending the password in the same email as the file defeats much of that protection.
Create a unique passphrase
Use a long, unpredictable passphrase that is not reused for an account. Record it in a password manager before downloading the protected file. There is no QuickMerge recovery service because the password and document are not stored by QuickMerge.
Test the recipient workflow
Open the exported PDF in a second viewer and confirm it asks for the password. Browser, mobile and older desktop viewers do not all support the same encryption features. Check compatibility before relying on the file for an urgent submission.
Separate confidentiality from authenticity
Encryption limits access; it does not prove who created the document or whether it was changed. Use a digital-signature workflow when authenticity and tamper evidence matter. Once a recipient has opened the PDF, they may still copy, photograph or redistribute its contents.
Security guidance reviewed 11 July 2026 · Editorial policy
Real AES-256, and the limits worth understanding
This tool applies genuine encryption through qpdf compiled to WebAssembly. That is a real security control, with real boundaries.
There is no recovery if you forget the password
The encryption is not a formality and there is no back door, no reset and no recovery — least of all here, where neither the file nor the password ever reaches a server. Record the password somewhere durable before you send the document on.
A weak password undoes strong encryption
AES-256 is not the weak point; a guessable password is. A short or common password can be attacked offline, at speed, by anyone holding the file. Generate a strong one rather than reusing something memorable.
Permissions are weaker than the open password
A PDF can carry restrictions on printing or copying that are enforced by the reader rather than by cryptography, and plenty of software ignores them. The password that stops the document opening at all is the part that genuinely holds.
How to encrypt a PDF file, and the part everyone gets wrong afterwards
Applying the encryption is the easy half. What decides whether the document is actually protected is the password and how it reaches the recipient.
The password is the weak point, not the cipher
AES-256 is not going to be broken. A password someone can guess, or one that appears in a breach list, will be — and an attacker holding the file can try candidates offline, as fast as their hardware allows, with nothing to rate-limit them. Generate a strong one rather than reusing something memorable, because a memorable password is the one that is already in a wordlist.
Do not send the password with the document
A password emailed in the same thread as the encrypted file protects against nothing except a mistyped address. Send it by a different route — a phone call, a message on another service — and it becomes a real control, because compromising one channel is no longer enough. This is the most commonly skipped step and the one that does the most work.
There is no recovery, and here that is literal
Neither the file nor the password reaches a server, so there is no copy to recover from and no support route that can bypass it. Forgetting the password means the document is gone. Record it somewhere durable before you send the file, not afterwards.
macOS and Windows compared
On a Mac, Preview can add a password through File → Export as PDF with the Encrypt option, and Quartz filters make it fiddlier than it should be. Windows has nothing built in — Word can export a PDF with a password if the document started in Word, but there is no way to protect a PDF you already have without installing something. That gap is why most people looking to encrypt a PDF file on Windows end up at a website, and why it matters whether that website uploads the file.