Nothing is uploaded. When you choose or drop a PDF, the tool reads it locally with the browser File API, encrypts it on your own machine with the @pdfsmaller/pdf-encrypt-lite library and returns the protected file from a local Blob for download. There is no server, upload, database, login or tracking in the processing path, which matters because the PDFs people protect — contracts, bank statements, medical records, ID scans — are exactly the documents you would not want to hand to a cloud service. The file and the password you type stay in the tab; the tool works offline once the page is cached, and closing the tab discards everything. The only optional network use anywhere on the site is consent-gated advertising, which never sees your files.

This tool applies 128-bit RC4 encryption — the algorithm the PDF 1.7 standard (ISO 32000-1) defines and that desktop PDF software, Chrome and Firefox all open natively — through the battle-tested @pdfsmaller/pdf-encrypt-lite library. RC4 at 128 bits reliably blocks anyone without the password from opening the document and is the most broadly compatible option, which is why it remains common. Be aware of the trade-off, though: RC4 is an older cipher that cryptographers consider weaker than AES, and it was deprecated in the newer PDF 2.0 specification in favour of AES-256. For everyday privacy — keeping a statement or contract away from casual eyes — 128-bit RC4 with a strong password is perfectly serviceable. For data where a determined, well-resourced attacker is a real threat, prefer a tool that writes AES-256, and always pair it with a long, high-entropy password, because the password’s strength matters more than the cipher for real-world attacks.

A document-open password is not stored anywhere: it is only ever used, in your browser, to derive the key that encrypts the file, and it is never transmitted or saved. That is the point of genuine client-side encryption — there is no server-side copy and no backdoor — but it also means a forgotten password cannot be reset or recovered by anyone. Before you protect an important document, write the password down in a password manager or another safe place, and consider keeping an unprotected original in secure storage. The tool helps you avoid a lockout at the moment of protecting: it requires you to confirm the password in a second field and shows a live strength meter with show/hide toggles so you can verify exactly what you typed. If you later have the password but want to remove the protection, the companion Unlock PDF tool strips it back off in the browser.

Protect PDF is completely free with no account, watermark or limit, and because it is 100% client-side it works in any modern browser on Android, iPhone, iPad, Windows, macOS or Linux without installing an app. The output is a standard encrypted PDF written to the PDF 1.7 (ISO 32000-1) specification, so it is fully interoperable: open it in desktop PDF software, Apple Preview, Chrome, Edge, Firefox or any conforming reader and you will be prompted for the password before the pages appear. One PDF is protected at a time and the practical ceiling is your device’s memory, so a very large file is bounded by available RAM; on a phone a big document may encrypt a little more slowly, but the result is the same portable, password-protected PDF.