QuickMergeAdd Password Protection to a PDF
Short answer: To password-protect a PDF, choose a strong password and download the encrypted copy. QuickMerge applies AES-256 encryption in your browser, so neither the file nor password is uploaded.
Add a password with real AES-256 encryption — the same qpdf engine used on servers, compiled to WebAssembly and running in your browser. Your file and your password never leave this device.
How do I password-protect a PDF?
Drag & drop here
or click to browse
Genuine AES-256 Encryption, Entirely In Your Browser
This tool runs qpdf, compiled to WebAssembly inside your browser, and requests 256-bit AES encryption. The password is applied on your device and neither it nor the PDF is sent to a QuickMerge processing server.
The automated regression suite independently verifies the output with the repository's pinned pdf.js parser: no password and a wrong password fail, while the correct password opens the expected content. PDF readers differ, particularly older ones, so test the downloaded file in the recipient's actual viewer before an urgent submission.
Next steps
Before this step
- compress before encrypting — compression works on the unencrypted file.
- remove sensitive content first — a password protects the file, not the information inside it.
Related tools
- remove a password you already know — the reverse of this operation.
Browse all PDF tools, or see every QuickMerge tool.
No completed size benchmark is published for this tool. See measurement coverage and limitations; stated upload limits are application guards, not tested device capacity.
Frequently Asked Questions
Real encryption. The document content is encrypted with AES-256 by qpdf, the same engine used in server pipelines worldwide. Without the password the content is cryptographically unreadable — not hidden, encrypted.
There is no recovery, no backdoor, and we never see the password — it exists only in your browser's memory during encryption. Store it in a password manager.
Modern readers that support AES-256 PDF encryption should prompt for the password. Compatibility is not universal across old or specialised viewers, so test the downloaded copy in the recipient's actual reader.
The browser downloads and starts the qpdf WebAssembly engine on first use. Later runs may use the browser cache. The PDF and password are processed locally.
The regression suite creates a protected fixture, confirms missing and wrong passwords fail, and opens the expected content with the correct password using a separately pinned pdf.js parser. Recipient-reader testing remains important.
The document cannot be opened, by you or anyone else. Nothing was uploaded, so there is no copy to recover and no support route that can bypass it. Store the password before sharing the file.
Protect access with a known password
The implementation requests AES-256 encryption. Verify the saved copy in a compatible PDF reader.
Use an unpredictable password
A person holding an encrypted file can attempt guesses offline. Generate a long, unique value and retain it in a password manager. Permission flags about printing or copying are separate from an opening password.
Test the receiving copy
Reopen the exported PDF in a fresh viewer session. Confirm that the correct password works and an incorrect one is rejected. Check page count and required document features after encryption.
Keep the source and password recoverable
QuickMerge has no server copy of your selected document or password. Keep your own original and password record. Where appropriate, share the password through a separately agreed channel.