Password protect a PDF in seconds
Lock any PDF with AES-256 encryption (FIPS 197) — one password, set in your browser, never sent anywhere. Free, no Adobe ID, no permission-flag menu to get wrong.
How it works
Drop your PDF
A file up to 100 MB, loaded straight into your browser tab — there is no upload, so there is nothing in transit to intercept.…
Choose a password
Type it twice to confirm. NIST SP 800-63B recommends 12 or more characters and explicitly advises against composition rules, so a memorable passphrase beats a short jumble.…
Download the encrypted PDF
AES-256 encryption is applied by qpdf running in WebAssembly on your own machine, and the locked file prompts for the password in Adobe Acrobat Reader, Apple Preview, Microsoft Edge and…
Why choose iFillPDF
AES-256 (FIPS 197) — PDF 2.0 standard
The same Advanced Encryption Standard NIST SP 800-175B approves for US government TOP SECRET data and HIPAA 45 CFR §164.312(a)(2)(iv) accepts for ePHI. Stronger than Adobe Acrobat Pro free tier (still ships AES-128 by default).
One password, deliberately
The PDF specification allows a two-tier model — a user password to open the file and an owner password to change permissions — and this tool keeps both slots aligned to the same secret.…
AES-first protection with one password
The tool focuses on the protection that actually holds: AES-256 encryption for opening the file. PDF permission flags for printing, copying, annotating, extracting or form-filling are advisory and only enforced by readers that…
Nothing is uploaded — no server to trust
Encryption runs entirely in your browser through qpdf compiled to WebAssembly, so the document and the password never leave your machine.…
Technical details
Encrypt any PDF with AES-256 (ISO 32000-2:2020, FIPS 197 — the standard NIST SP 800-175B and HIPAA 45 CFR §164.312(a)(2)(iv) accept for ePHI), using qpdf compiled to WebAssembly and running inside your own browser tab: the file and the password never reach a server. One password does the whole job — it both opens the document and governs its permissions, so there is nothing to forget and no second secret to distribute. The workflow keeps one strong password for opening and permissions, which avoids distributing a second secret. The result prompts for the password in Adobe Acrobat, Apple Preview, Foxit and any modern reader. No Adobe ID, no upload, no AI training on your documents.
Go further with lifetime access
E-signature proof log, business templates, no watermark. $8.99, one payment, for life — no subscription.
Frequently asked questions
Is iFillPDF really free for password protection?+
Yes — genuinely free, no credit card and no Adobe ID required, and the encrypted PDF carries no watermark because the tool never re-renders your pages. Lifetime is $8.99 paid once, with AI Deep Detect in one-time credit packs. Compare: Adobe Acrobat online is free but caps you at one protect-PDF per day after sign-in; Smallpdf free tier limits two documents per day; iLovePDF free has 25 MB cap; Sejda is $7.50/mo or 3 tasks/hour free; Foxit PhantomPDF is $129 one-time license.
How strong is AES-256 vs AES-128?+
AES-256 has 2^256 possible keys — brute-forcing one with all current Bitcoin mining hardware would take longer than the age of the universe. NIST SP 800-175B classifies it as quantum-resistant for symmetric encryption (Grover algorithm only halves effective strength to AES-128 equivalent). PDF 2.0 (ISO 32000-2:2020) deprecated RC4-40 and RC4-128 — older Adobe Acrobat, Smallpdf legacy and Soda PDF $7.99/mo still ship those weak modes by default.
Is iFillPDF HIPAA-compatible for medical PDFs?+
AES-256 satisfies the HIPAA Security Rule 45 CFR §164.312(a)(2)(iv) addressable encryption specification and §164.312(e)(2)(ii) transmission security, and since this tool encrypts in your browser no PHI reaches us at all. HHS guidance is explicit, though, that a password-protected PDF on its own is not HIPAA compliance — that requires a covered-entity agreement, audit logging and breach-notification procedures around it. We sign Business Associate Agreements (BAA) with the Lifetime offer. Also covers GLBA 16 CFR Part 314 Safeguards Rule for financial advisors, ESIGN Act 15 USC §7001 for signed contracts and SOX §404 for audit trail integrity. EU hosting is HHS OCR acceptable when paired with BAA.
What if I forget my PDF password?+
The file is gone, and we mean that literally — AES-256 with a 12-character password is computationally unbreakable. We could not retain your password even if we wanted to, since it is never transmitted anywhere, and we will not bypass it (would defeat the cryptography and violate 18 USC §1030 CFAA). Best practice: store passwords in 1Password, Bitwarden or Apple Keychain before sharing. PDF/A-3 (ISO 19005-3) archival files should be stored unencrypted in a separate secure vault — encryption is for transit, archival relies on access control.
More PDF tools
Keep going with a related tool — try without signing up, free account to download.