Lock a PDF With Real AES-256 Encryption
Seal a document inside a password-protected file that only the right password can open.
About the PDF Password Protector
This works differently from the password option in a desktop PDF editor, and the difference matters. Rather than setting a flag inside the PDF, the document is genuinely encrypted with AES-256 and sealed inside a small self-contained HTML file. Open that file in any browser, type the password, and the original PDF is decrypted and downloaded. Get the password wrong and there is nothing to recover, because the contents are ciphertext rather than a readable file with a lock on the front.
That distinction is the whole point. A conventional PDF password is enforced by the reader honouring it, which is why password-removal utilities are so effective against them. Here the bytes themselves are unreadable without the key. The trade-off is the format: what you send is an .html file, not a .pdf, so tell your recipient what to expect. Encryption is performed in your browser, and decryption happens in theirs, with no server in between at either end.
Key Features
- Genuine AES-256 encryption: The document is encrypted rather than flagged as protected, so the contents cannot be read without the password.
- Strong key derivation: The password is put through two hundred thousand hashing rounds with a random salt before a key is derived from it.
- Opens in any browser: The recipient needs no software or account — the file carries its own unlock page.
- Tamper detection: The encryption mode verifies integrity, so a wrong password or altered file is rejected rather than producing garbage.
- No server on either side: Sealing happens on your machine and unsealing on theirs, so the document exists in the clear nowhere else.
How to Use the PDF Password Protector
- Add the PDF you want to protect.
- Choose a strong password and type it twice to confirm.
- Create the protected file and download the .html vault.
- Send the file, and give the recipient the password through a separate channel such as a phone call.
How It Works
A random salt and initialisation vector are generated, the password is stretched into a 256-bit key using PBKDF2 with two hundred thousand iterations of SHA-256, and the PDF bytes are encrypted with AES in GCM mode using the browser's own cryptography interface. The salt, vector and ciphertext are embedded into an HTML page containing a small unlock routine that reverses the process. Two practical consequences: the encrypted data is stored as text inside the page, so the resulting file is roughly a third larger than the PDF it contains, and there is no recovery path whatsoever — the password is never stored anywhere, so losing it means losing the document.
When You Need It
A counsellor writing up a session summary for a client has to get it to them somehow, and ordinary email is an insecure channel that leaves copies on servers neither party controls. Sealing the report and sharing the password by phone means an intercepted or misdirected message reveals nothing. The document records someone's mental health in detail, which is about as sensitive as personal data gets, so encrypting it through a website that receives the plaintext first would defeat the exercise entirely. Advisers sending financial summaries and consultants issuing confidential findings protect documents the same way.