How to password-protect a PDF (and safely remove the password later)

Email was not designed to be private. A message passes through multiple servers, sits in backups, gets forwarded without much thought, and lands in inboxes that may or may not be well secured. For most correspondence that is fine. For a payslip, a medical letter, a tax return or a contract with commercial terms, it is worth a moment's thought.

Encrypting the PDF means that even if the file ends up somewhere it should not, it is unreadable noise to whoever opens it.

What PDF encryption actually does

This is real cryptography, not a politely-honoured setting. When you apply a password, the document's contents are encrypted with AES — the same algorithm class used to protect data in transit across the internet. Without the password, there is nothing meaningful to read.

It is worth distinguishing this from the other kind of PDF protection you may have encountered. Some PDFs carry permission restrictions — no printing, no copying — which are enforced by the reader rather than by mathematics, and are consequently easy to bypass. An open password is different in kind: the file simply cannot be decoded without it.

How to encrypt a PDF

1. Upload the document you want to protect.
2. Choose a strong password — length matters far more than special characters.
3. Record the password somewhere reliable before you go any further.
4. Download the encrypted copy.
5. Open it once to confirm it prompts for the password.

Step three is not optional advice. There is no recovery mechanism for an encrypted PDF, by design. If you forget the password, the document is gone — not inconvenient, gone. Put it in a password manager at the moment you create it.

The mistake almost everyone makes

Sending an encrypted attachment and the password in the same email protects nobody. Anyone who can read one can read the other.

This is genuinely the most common error, and it makes the entire exercise theatre. If an attacker has access to the mailbox or intercepts the message, they now have both halves. The encryption has cost you effort and bought you nothing.

Send the document by email and the password by a different channel: a text message, a phone call, a messaging app, or in person. It takes an extra thirty seconds and it is the difference between real protection and the appearance of it.

Choosing a password worth using

Length beats complexity, consistently. A four-word phrase is dramatically harder to break than eight characters of punctuation, and it has the practical advantage of being readable over the phone without spelling out symbols.

• Aim for 16 characters or more where you can.
• Avoid anything guessable from context — the client's name, the invoice number, the current month.
• Do not reuse a password you use elsewhere, particularly not one protecting an account.
• Store it in a password manager, not in the covering email or a note on your desktop.

Removing a password you know

Encryption often outlives its usefulness. Banks and payroll providers send statements encrypted with a date of birth or the last digits of an account number, which made sense in transit and is pure friction once the file is sitting in your own archive. Being asked for a password every time you open your own statement — and having to remember which scheme applied that year — makes an archive practically unusable.

There is a workflow reason too. Encrypted PDFs cannot be merged, compressed, converted, searched or OCR'd, because none of those tools can read the contents. If you need to combine twelve monthly statements for an accountant, the passwords have to come off first.

To be explicit about what this does and does not do: unlocking requires you to supply the correct password. It decrypts a document you already have legitimate access to. It does not guess, crack or bypass encryption on a file you cannot open, and no reputable tool will offer to.

A sensible working order

Encryption should be the last thing you do. If a document needs merging, compressing or converting, do all of that first and apply the password to the finished file. Trying to work on an encrypted document simply fails, because the tools cannot read it.

The reverse applies when you receive something protected: unlock it, do your work, and re-apply protection if the result still needs to be restricted. Keep the unlocked copy somewhere sensible in the meantime — a decrypted payslip sitting in your Downloads folder is a small step backwards.