Sharing a PDF that contains sensitive information without a password is like emailing a physical document — anyone who intercepts or receives it can read everything. Password-protecting a PDF takes under a minute, and the right tool lets you do it without uploading your confidential file to anyone's server. This guide explains how PDF encryption works, the difference between user and owner passwords, and how to add both for free.
Why Password Protect a PDF?
PDF encryption serves two distinct purposes that are often confused: preventing unauthorised access and restricting what authorised users can do. Understanding both helps you choose the right settings for your situation.
- Contracts and legal documents. Before signing, a draft contract should only be readable by the intended recipient. An open password ensures it can't be read if the email is forwarded or the file is found on a shared drive.
- Financial reports and statements. Salary data, bank statements, and P&L reports sent by email are exposed to anyone with access to the recipient's inbox. Encryption limits that exposure.
- Portfolios and creative work. Sharing a design portfolio with a prospective client is necessary — but you may not want them to print copies or extract images. Permission restrictions handle this without blocking access entirely.
- HR and medical records. Compliance requirements in many industries mandate that documents containing personal data be protected before transmission. PDF encryption is a simple, auditable control.
- Client proposals and pricing documents. A proposal sent to one client shouldn't be easily forwarded to a competitor. A password forces a deliberate act before the document can be shared.
User Password vs Owner Password — What's the Difference?
PDF encryption supports two distinct password types that serve completely different purposes. Most people only know about one of them.
The two PDF password types
User Password
Also called the open password. Required every time someone tries to open the PDF. Without it, the document is completely inaccessible — the content is encrypted and unreadable.
Use this when you want to restrict who can read the document at all.
✓ Free in DenaliKitOwner Password
Also called the permissions password. Does not prevent the document from being opened — instead it controls what the reader can do: print, copy text, edit, or annotate.
Use this when you want to share content freely but restrict what recipients can do with it.
⭐ Premium in DenaliKitWhat Permissions Can You Restrict?
When you set an owner password, you can control the following permissions independently:
| Permission | What It Controls | Typical Use Case | DenaliKit |
|---|---|---|---|
| Printing | Whether the PDF can be printed at all, or only at low resolution | Digital-only distribution, preview copies | ⭐ Premium |
| Copying text | Whether text can be selected and copied to the clipboard | Protecting proprietary content, contracts | ⭐ Premium |
| Editing | Whether the document can be modified in a PDF editor | Final documents, signed contracts | ⭐ Premium |
| Annotations | Whether comments and highlights can be added | Published documents, archived records | ⭐ Premium |
| Form filling | Whether interactive form fields can be completed | Read-only reference documents | ⭐ Premium |
| Open password | Whether a password is required to open the file at all | Any sensitive document | ✓ Free |
What Encryption Standard Does DenaliKit Use?
DenaliKit uses 128-bit RC4 encryption — the PDF 1.4 standard, which has been the baseline for PDF security since Adobe Acrobat 5 and is supported by every PDF reader in existence, including Preview on macOS, Adobe Acrobat, Chrome's built-in viewer, and mobile apps.
For context, here's how the main PDF encryption standards compare:
| Standard | Key Length | PDF Version | Reader Support | Security Level |
|---|---|---|---|---|
| RC4 40-bit | 40-bit | PDF 1.1–1.3 | Universal | Weak — avoid |
| RC4 128-bit | 128-bit | PDF 1.4 | Universal | Good for most uses ✓ |
| AES 128-bit | 128-bit | PDF 1.6 | Acrobat 7+ | Strong |
| AES 256-bit | 256-bit | PDF 1.7 | Acrobat 9+ | Very strong |
Choosing a Strong Password
The encryption algorithm is only as strong as the password protecting it. This is by far the most important factor in PDF security.
Weak
Short, common words or simple patterns. Crackable in seconds with dictionary attacks.
password123Moderate
Mixed case with numbers. Harder, but still vulnerable to targeted attacks.
Contract2026!Strong
Random, long, mixed characters. Computationally impractical to brute-force.
k#9Lm$2wXpQ7- Use at least 12 characters. Each additional character multiplies the number of combinations exponentially. 12 characters is the practical minimum for sensitive documents.
- Use a password manager. Tools like 1Password, Bitwarden, or iCloud Keychain generate and store strong random passwords. You share the document password separately (e.g. via a text message, not the same email as the PDF).
- Never use the document name as the password. "Contract_Acme_2026.pdf" with password "acme2026" is the first thing anyone will try.
- Send the password through a different channel. If the PDF goes by email, send the password by text message or a separate app. A single compromised channel shouldn't expose both.
The Privacy Problem with Online PDF Encryption Tools
Here's the fundamental irony of most online PDF encryption services: to encrypt your confidential document, you must first upload it unencrypted to their server.
That means a copy of your unprotected document — the same document you're trying to secure — sits on a third-party server during processing, and possibly for hours or days afterward depending on their retention policy.
For contracts, medical records, HR files, or financial data, this is a serious problem. You're creating exactly the security exposure you're trying to prevent.
Step-by-Step: Encrypt a PDF with DenaliKit
Open the PDF Toolkit
Go to denalikit.com/app/pdf-toolkit.html. Adding an open password is completely free — no account needed. Owner passwords and permission restrictions require a small one-time Premium upgrade.
Select "PDF Encrypt" from the tool list
Click PDF Encrypt in the left panel. The workspace loads with password fields and permission checkboxes visible. Free users see the user password field active; Premium fields are clearly labelled.
Drop your PDF into the upload area
Drag your PDF onto the drop zone or click to browse. The file loads into browser memory — nothing is uploaded.
Enter your user password
Type a strong password in the User Password field. This is the password recipients will need to open the document. Use at least 12 characters — a mix of letters, numbers, and symbols.
Set owner password and permissions (Premium)
If you have Premium, add an owner password and check any permissions you want to restrict — printing, copying, and editing can each be turned off independently.
Click Encrypt and download
Click Encrypt PDF. The encrypted file downloads as filename_encrypted.pdf within seconds. Store the password safely — it cannot be recovered if lost.
Can a PDF Password Be Cracked?
Honestly — yes, in theory. But the practical risk depends heavily on the strength of your password and the attacker's motivation.
Dictionary attacks
Automated tools try millions of common words, phrases, and variations per second. A password like "contract2026" would fall in minutes. A random 12-character password would take longer than the age of the universe to brute-force at current computing speeds.
Brute force
Trying every possible combination. At 128-bit RC4, even modern GPUs can only attempt billions of combinations per second — which sounds fast until you realise a 12-character mixed-character password has approximately 10²² possible combinations.
Social engineering
The most common real-world attack isn't technical — it's simply asking the recipient to forward the password. This is why sending the password through a different channel than the document matters.
How to Remove a Password from a PDF
If you own the document and know the password, removing it is straightforward:
- macOS Preview: Open the PDF, enter the password, then File → Export as PDF — leave the password fields blank in the export dialog.
- Adobe Acrobat Pro: File → Properties → Security → No Security → Save.
- Chrome: Open the encrypted PDF in Chrome (enter the password when prompted), then File → Print → Save as PDF. The saved file has no password.
- DenaliKit: Open the encrypted PDF in the toolkit — it will prompt for the password — then use any other tool (compress, rotate, etc.) and download. The output is unencrypted.
Frequently Asked Questions
Can I password protect a PDF for free?
Yes. DenaliKit's open password (user password) feature is completely free — no account needed. This prevents anyone without the password from opening the document. Owner passwords and permission restrictions (disable printing, copying, editing) require a small one-time Premium upgrade. See pricing →
Is it safe to encrypt a confidential PDF online?
With most tools, no — they upload your unencrypted file to a server, which defeats the purpose for sensitive documents. DenaliKit encrypts entirely in your browser. Your file and password are never transmitted anywhere.
What's the difference between a user password and an owner password?
A user password prevents the document from being opened without it. An owner password doesn't block access but controls what the reader can do — print, copy text, edit, annotate. You can set one or both.
Can I encrypt a PDF that already has a password?
You'll need to remove the existing password first. Open the PDF in DenaliKit (it will prompt for the current password), use any tool to process it, and save the output — which will be unencrypted. Then re-encrypt with your new password settings.
Does encrypting a PDF increase the file size?
Very slightly — typically less than 1% for an open password. The encryption adds metadata but doesn't re-encode the document content. The file size difference is negligible in practice.
Will the encrypted PDF work on all devices?
Yes. DenaliKit uses 128-bit RC4 encryption (PDF 1.4 standard), which is supported by every PDF reader — Adobe Acrobat, Preview on macOS, Chrome, Firefox, iOS Files app, Android, and all others. Recipients will simply see a password prompt when they open the file.