Lock PDF Online

Why Password-Protect a PDF?

A PDF often contains something you do not want everyone to see. Contracts, tax returns, medical records, bank statements, payslips, ID scans — all of these travel as PDFs, and all of them are dangerous if they fall into the wrong hands. Password protection is the simplest way to keep them safe: without the password, the document's content is encrypted and unreadable.

The Web Tool Bazar PDF Locker gives you two complementary tools. Lock PDF wraps an existing PDF in encryption with a password you choose. Unlock PDF removes the password from a protected PDF you can already open. Both work entirely in your browser using the Web Crypto API and pdf-lib — your file never travels across the internet, which matters a lot when the document is confidential.

The tool supports the two encryption standards that matter today: AES-256 (the strongest option, introduced in PDF 2.0) and AES-128 (PDF 1.6+, compatible with Adobe Acrobat 7 and later). RC4, once standard, is not offered because it is cryptographically broken and can be cracked in seconds on modern hardware.

User Password vs Owner Password

PDF encryption uses two distinct passwords, and understanding the difference is the key to using the tool well.

User password — required to open the document

The user password is the one everyone thinks of when they think of a "password-protected PDF." Without it, the reader cannot decrypt the content of the pages. Text, images, and everything else inside the document is unreadable until the correct user password is supplied. This password is required — the tool will not let you lock a PDF without one.

Owner password — required to change permissions

The owner password controls the permission flags inside the encrypted document: whether the reader may print it, copy text from it, modify it, or annotate it. A reader who opens the file with the user password sees the document but is bound by whatever permissions the owner set. A reader who knows the owner password can change those permissions. If you only care about who can open the file, leave the owner password empty — the tool will use the user password for both.

When to use different passwords

Use separate passwords when you want to distribute the file to someone who should be able to read it but not change its restrictions. For example: a contract you send to a client, where you want the client to read and print but not edit. Set a user password the client knows, and an owner password only you know. If the client later asks for editing rights, you can unlock the file with the owner password and re-save it with different permissions.

Common PDF Locking Use Cases

How PDF Encryption Works Under the Hood

Stage 1 — Read the source PDF

The tool reads the bytes of your PDF and parses its object graph with pdf-lib. Every object — page, content stream, font, image, annotation — is loaded into memory exactly as it was written.

Stage 2 — Derive the encryption key

From the user password, the tool derives an encryption key using the standard PDF security handler defined in ISO 32000. For AES-256, the key is derived with SHA-256 and stored in the file's encryption dictionary. For AES-128, the standard RC4-based key derivation with AES-CBC is used. The password is never written to the file in any form — only the key derived from it.

Stage 3 — Encrypt the content

Each content stream, embedded font, and image is encrypted with the derived key. The object streams and cross-reference table are also encrypted for PDFs that use compressed object streams (though AES-256 in this tool writes uncompressed object streams for maximum compatibility). The result is a document whose page content is unreadable without the key.

Stage 4 — Write the encryption dictionary

The output PDF contains an encryption dictionary that records the algorithm identifier, the permission flags, and the hashed passwords. This dictionary is what a compliant reader uses to prompt for a password and to enforce permissions. The permission flags are advisory: a reader that chooses to ignore them can, but every mainstream reader honours them.

Stage 5 — Unlocking a protected PDF

When you use the Unlock mode, the tool loads the encrypted PDF with the password you supply. pdf-lib-encrypt validates the password against the hashed values in the encryption dictionary. If the password matches the user password, the content is decrypted. The tool then saves a fresh PDF without an encryption dictionary, producing a decrypted copy. If the password does not match, the tool throws an error — it never silently produces a corrupted file.

What gets preserved

Locking a PDF does not alter its content in any way. Text stays selectable (after unlocking), images keep their resolution, fonts stay embedded, and the visual layout is unchanged. Encryption wraps the existing objects — it does not re-render, re-compress, or flatten anything. If the file was already rotated, split, or signed, those properties carry through to the encrypted output.

How to Lock a PDF — Step by Step

Best Practices for PDF Encryption

• Use AES-256 unless you have a specific reason not to. It is the strongest standard, and every modern reader supports it. Only choose AES-128 if you know a recipient is using a reader from before 2006.
• Use a long password. PDF encryption is strong, but password strength still matters. A 12-character passphrase of random words is far stronger than a short password with symbols.
• Do not lose the password. There is no recovery. If you forget the user password, the encrypted content is unrecoverable — not by us, not by anyone.
• Share the password over a different channel. Send the PDF by email and the password by SMS or a messaging app. That way an email breach alone does not expose both.
• Remember that permissions are advisory. A compliant reader honours the print/copy/edit flags. A non-compliant reader does not. Treat encryption — not permissions — as the real protection.
• Keep a copy of the unlocked original. If you later need to change permissions or the password, you will need the original file and its password. Do not overwrite it with the encrypted version.
• Unlock before editing. If you plan to edit the PDF with our Edit PDF tool, do that first, then lock the result. Editing an encrypted PDF requires unlocking it first anyway.

Who Should Use This Tool?

• Anyone emailing a confidential PDF — a contract, a payslip, a tax return, a medical record — who wants a second layer of protection.
• Accountants and bookkeepers exchanging financial documents with clients and tax authorities.
• Legal professionals distributing contracts, agreements, and settlement documents.
• HR departments sending offer letters, payroll details, and performance reviews.
• Medical practices sharing patient records and test results with other providers.
• Freelancers and contractors sending proposals, invoices, and deliverables to clients.
• Students and researchers protecting draft papers and unpublished data.
• Anyone archiving sensitive documents who wants to add a password before storing the file long-term.

Troubleshooting Common Issues

The reader says my password is wrong even though I typed it correctly.

Passwords are case-sensitive. Check that Caps Lock is off and that you have not accidentally copied a leading or trailing space. If you are copying the password from a message, make sure the whole password is selected — some messaging apps include the newline at the end when you copy a line.

My file is not accepted when I try to upload it.

The tool accepts PDF files only. Make sure the file has a .pdf extension and opens in another PDF reader. If the file is a scan saved as an image, convert it to PDF first.

I set a password but the PDF opens without asking for one.

Some readers cache previously opened documents and skip the prompt. Close the reader completely and reopen the file. If it still opens without a password, the encryption may have failed silently — try locking again and check the output file size, which should differ slightly from the input.

Can I lock an already-locked PDF?

No. If the PDF is already encrypted, the tool cannot read its content to re-encrypt it. First use the Unlock mode with the current password to produce a decrypted copy, then lock that copy with a new password.

Can I remove a password I do not know?

No. PDF encryption is designed to be unbreakable without the password. If you do not know the user password, the content cannot be recovered by this tool or any other legitimate tool. Do not use "PDF password crackers" from unknown sources — they are usually malware.

The encrypted PDF is larger than the original.

Encryption adds an encryption dictionary and re-writes the object structure. The increase is typically a few kilobytes. For very small PDFs the relative increase can look large, but the absolute difference is tiny. Run the output through our Compress PDF tool if you need to shrink it.

My old reader cannot open the AES-256 file.

AES-256 requires PDF 2.0, supported by Acrobat X (2010) and later, plus all current browsers and mobile readers. If a recipient is using an older reader, re-lock the document with AES-128, which is supported by Acrobat 7 (2005) and later.

Frequently Asked Questions

Final Thoughts

Locking a PDF should be simple, strong, and private. The Web Tool Bazar PDF Locker delivers all three: AES-256 and AES-128 encryption, separate user and owner passwords, granular permission controls for printing, copying, modifying and annotating, a live preview of the source document, and a strict local-only processing model that keeps your confidential file on your own device.

Whether you are emailing a contract, protecting a tax return, locking an ID scan, or removing an old password before archiving a file, this tool handles the job cleanly and securely. Bookmark it for the next time you need it — and explore our other PDF tools like Edit PDF, Sign PDF, Rotate PDF, Repair PDF, Split PDF, Merge PDF, Organize PDF, Crop PDF, Remove Pages, Compress PDF, Upscale PDF, Invert Colors, and Add Watermark, all built with the same privacy-first philosophy.