Lock / Unlock PDF

Choose Lock PDF, drop the file in, and type an Open Password: that is the one anyone must enter before the PDF will open. Keep the encryption on AES-256, add a separate Permissions Password if you want to restrict printing or copying, then download the protected copy. Store the password somewhere safe. There is no reset or recovery for it, here or anywhere else.

Choose Unlock PDF, drop the file in and enter its current password, then download a copy that opens without one. You do need to know the password: removing it means decrypting the file, and that takes the key. A PDF that opens freely but blocks printing or copying is handled too; those restrictions are lifted without a password prompt.

The User (Open) password is required to open the document at all — without it the contents cannot be read. The Owner password lets the document open freely but declares restrictions on what can be done with it, and is required to change them. They serve different purposes: use an Open password when the content itself must stay private, and an Owner password when you want people to read it but not print or copy it. If you set only an Open password, this tool uses it as the Owner password too, which means anyone who can open the file authenticates as its owner — set both separately if the restrictions need to hold.

Yes. Switch off Allow Printing and Allow Copying, and leave Allow Form Filling on. Form filling is a separate permission bit in the PDF specification, which is why the combination works — and it also covers signing a signature field that already exists in the document.

Not reliably, and it is important to know that before relying on them. Permissions are a declaration in the file that conforming readers choose to honour — Acrobat, Preview and the mainstream browsers all do. Nothing cryptographic enforces them, so a determined tool can ignore them, and plenty do. Treat permissions as a clear statement of what you are and are not authorising, and use an Open Password when the content genuinely must not be read by the wrong people. That one is enforced by the encryption itself.

AES-256 unless you have a specific reason not to. It is the strongest option here and the encryption is real — a 256-bit AES handler with the permissions cryptographically bound into the document. The trade-off is compatibility: AES-256 in PDF is part of PDF 2.0, so Acrobat 9 and earlier, along with a long tail of mobile, embedded and in-car viewers, cannot open the file at all. RC4-128 opens virtually anywhere, but it is cryptographically broken and should be treated as a way to declare permissions rather than to keep anything secret. AES-256 also needs a secure connection, which this page has.

No legitimate tool can break standard AES-256 encryption without the key. Decryption requires providing the correct existing User or Owner password to remove the security wrapper.