How to Encrypt a PDF With AES-256 or AES-128

Encrypt a PDF step by step

1. 1

   Add your file to Encrypt PDF

   Open Encrypt PDF and drop the PDF in, or click Choose file. The file must not be encrypted already.

2. 2

   Set the open password

   Fill in Open password and Confirm password. To control the owner password yourself, tick Set my own owner password and type a different one. Otherwise a random owner password is generated on your device.

3. 3

   Choose the encryption settings

   In the Encryption panel pick AES-256 (recommended) or AES-128 (older readers). Leave Encrypt document metadata (title, author…) ticked unless you need it readable. Tick Also restrict what readers can do to set printing, copying, editing and comment rules.

4. 4

   Encrypt and save the owner password

   Click Encrypt PDF. The report shows the cipher read back from the new file. If an owner password was generated, it appears once under Generated owner password with a Copy button. Save it, then click Download PDF.

AES-256 or AES-128: which to pick

AES-256 uses a 256-bit key and the newest PDF security handler (PDF 2.0, also supported by Acrobat X and later). It handles passwords in any script, including Chinese, Arabic or emoji. Pick it unless you have a specific reason not to.

AES-128 uses a 128-bit key and the older handler from PDF 1.6. Choose it only when the file must open in very old readers or office scanners that reject AES-256. Its passwords are limited to Latin characters; the tool blocks any other characters because most readers could not open the result.

Neither option offers RC4 or 40-bit encryption. Those legacy ciphers are weak, and this tool does not write them.

Should the metadata be encrypted?

By default the XMP metadata (title, author, keywords and the like) is encrypted with everything else. Untick Encrypt document metadata if a document management system or search indexer has to read that metadata without the password. The page content stays encrypted either way. If the metadata holds anything you would rather not share, clear it first with Remove PDF Metadata or rewrite it with Edit PDF Metadata.

Open password vs owner password

• Open (user) password: required to view the file. This is the real protection, because the content is encrypted with a key derived from it.
• Owner password: lets someone change or remove the file's security and any restrictions. It must differ from the open password.
• Restrictions you set apply to people who open the file with the open password. They are flags that compliant readers honor, not extra encryption. Anyone who knows the open password can produce an unrestricted copy with the right software.

Encrypt a PDF from Microsoft Word

If the document starts in Word on Windows, choose File > Save As, pick PDF as the type, click Options, and tick Encrypt the document with a password. Word does not let you choose the cipher or set print and copy limits. When you need those controls, save a normal PDF and run it through Encrypt PDF.

When a simpler tool fits better

Encrypt PDF is the full-control option. If you just want a password with sensible defaults, Protect PDF is one panel with nothing to choose (see how to password protect a PDF). If you want limits on printing or copying while anyone can still open the file, use PDF Permissions.

Frequently asked questions