How to Encrypt a PDF with AES-256 (Free, No Upload)
Not all PDF encryption is equal. A lot of tools encrypt your PDF with outdated standards. You think you're protected. You're not.
Here's what actually matters, and how to encrypt a PDF correctly — for free, without uploading it anywhere.
## The Encryption Standards You Need to Know
PDF encryption has evolved through several standards. The one you want is AES-256.
**RC4 40-bit and 128-bit (PDF 1.x):** Old, broken. RC4 vulnerabilities are well-documented. Tools to crack RC4-encrypted PDFs are freely available. If your PDF editor is more than a few years old and you haven't checked what encryption it uses, it's probably RC4.
**AES-128 (PDF 1.6+):** Better, but not current best practice. Still acceptable for low-sensitivity documents. Not what you want for anything that matters.
**AES-256 (PDF 1.7, PDF 2.0):** Current standard. 256-bit key length. No known practical attack. This is what you want.
The problem: many online PDF encryption tools don't tell you what standard they're using. Some explicitly say "256-bit" but don't specify the algorithm — it might still be RC4. Ask, or check the output file's properties.
We use AES-256. PDF 2.0 standard. It's in our documentation and you can verify it by checking the encrypted file's security properties in any PDF reader.
## Two Types of PDF Passwords
PDF encryption has two separate password layers that most people conflate.
**User password (open password):** Required to open the document. Without this password, the PDF won't open.
**Owner password (permissions password):** Controls what an authorised user can do — printing, copying text, editing, form filling. This password isn't required to open the document, but it restricts capabilities.
You can set either or both independently. A document with only an owner password can be opened by anyone, but operations are restricted (in theory — permissions enforcement depends on the reader). A document with a user password requires the password to open at all.
For genuine confidentiality, you want a user password. For document control (preventing printing or copying of a document you're sharing with someone), you want an owner password. For both, set both.
## How to Encrypt a PDF With AES-256, for Free, Without Uploading It
1. Go to [WhisperDocs encrypt tool](/encrypt-pdf)
2. Drop your PDF onto the page
3. Set your user password and/or owner password
4. Choose your permissions settings
5. Download the encrypted file
That's it. The entire operation happens in your browser. Your file never goes to our servers — or anyone's servers.
Want to verify that? Turn off your WiFi before step 1. Everything works exactly the same. The encryption is done by JavaScript running locally on your device.
Open DevTools, go to the Network tab, watch what happens. Zero file uploads. The encrypted PDF is generated entirely in your browser.
## Password Strength Actually Matters
AES-256 is uncrackable by brute-force attacks on the algorithm. But dictionary attacks on weak passwords are trivially easy.
"password123" encrypted with AES-256 is still crackable in seconds with a dictionary attack. The encryption protects you from algorithmic attacks; your password protects you from dictionary attacks.
Good password practices for PDF encryption:
- Minimum 12 characters
- Mix of uppercase, lowercase, numbers, symbols
- Don't reuse passwords across documents
- Don't include information about the document's content (don't use the client's name as the password for their contract)
If you're sending an encrypted PDF to someone, send the password through a different channel. Don't put the password in the same email as the encrypted file.
## What About "Free" Cloud Encryption Tools?
Here's the irony: most cloud PDF encryption tools upload your unencrypted file to their server, encrypt it there, and send you back the encrypted version.
Your file traveled unencrypted to their server (protected only by TLS in transit), was processed there, and then the encrypted version came back. The unencrypted original existed on their infrastructure during processing.
That's backwards. The whole point of encryption is to protect the file. If it traveled unencrypted first, you've already exposed it.
Client-side encryption — encrypting in your browser before anything goes anywhere — is the right approach. Nothing unencrypted leaves your device.
## After Encryption: What to Check
After encrypting, verify the output:
1. Open the encrypted PDF in a reader and confirm it prompts for a password
2. Check the document properties (in most readers: File → Properties → Security) to confirm AES-256 is listed
3. Confirm the permissions you set are applied correctly
Takes 30 seconds. Worth doing.
[Encrypt a PDF now](/encrypt-pdf) — AES-256, in your browser, no upload.
Here's what actually matters, and how to encrypt a PDF correctly — for free, without uploading it anywhere.
## The Encryption Standards You Need to Know
PDF encryption has evolved through several standards. The one you want is AES-256.
**RC4 40-bit and 128-bit (PDF 1.x):** Old, broken. RC4 vulnerabilities are well-documented. Tools to crack RC4-encrypted PDFs are freely available. If your PDF editor is more than a few years old and you haven't checked what encryption it uses, it's probably RC4.
**AES-128 (PDF 1.6+):** Better, but not current best practice. Still acceptable for low-sensitivity documents. Not what you want for anything that matters.
**AES-256 (PDF 1.7, PDF 2.0):** Current standard. 256-bit key length. No known practical attack. This is what you want.
The problem: many online PDF encryption tools don't tell you what standard they're using. Some explicitly say "256-bit" but don't specify the algorithm — it might still be RC4. Ask, or check the output file's properties.
We use AES-256. PDF 2.0 standard. It's in our documentation and you can verify it by checking the encrypted file's security properties in any PDF reader.
## Two Types of PDF Passwords
PDF encryption has two separate password layers that most people conflate.
**User password (open password):** Required to open the document. Without this password, the PDF won't open.
**Owner password (permissions password):** Controls what an authorised user can do — printing, copying text, editing, form filling. This password isn't required to open the document, but it restricts capabilities.
You can set either or both independently. A document with only an owner password can be opened by anyone, but operations are restricted (in theory — permissions enforcement depends on the reader). A document with a user password requires the password to open at all.
For genuine confidentiality, you want a user password. For document control (preventing printing or copying of a document you're sharing with someone), you want an owner password. For both, set both.
## How to Encrypt a PDF With AES-256, for Free, Without Uploading It
1. Go to [WhisperDocs encrypt tool](/encrypt-pdf)
2. Drop your PDF onto the page
3. Set your user password and/or owner password
4. Choose your permissions settings
5. Download the encrypted file
That's it. The entire operation happens in your browser. Your file never goes to our servers — or anyone's servers.
Want to verify that? Turn off your WiFi before step 1. Everything works exactly the same. The encryption is done by JavaScript running locally on your device.
Open DevTools, go to the Network tab, watch what happens. Zero file uploads. The encrypted PDF is generated entirely in your browser.
## Password Strength Actually Matters
AES-256 is uncrackable by brute-force attacks on the algorithm. But dictionary attacks on weak passwords are trivially easy.
"password123" encrypted with AES-256 is still crackable in seconds with a dictionary attack. The encryption protects you from algorithmic attacks; your password protects you from dictionary attacks.
Good password practices for PDF encryption:
- Minimum 12 characters
- Mix of uppercase, lowercase, numbers, symbols
- Don't reuse passwords across documents
- Don't include information about the document's content (don't use the client's name as the password for their contract)
If you're sending an encrypted PDF to someone, send the password through a different channel. Don't put the password in the same email as the encrypted file.
## What About "Free" Cloud Encryption Tools?
Here's the irony: most cloud PDF encryption tools upload your unencrypted file to their server, encrypt it there, and send you back the encrypted version.
Your file traveled unencrypted to their server (protected only by TLS in transit), was processed there, and then the encrypted version came back. The unencrypted original existed on their infrastructure during processing.
That's backwards. The whole point of encryption is to protect the file. If it traveled unencrypted first, you've already exposed it.
Client-side encryption — encrypting in your browser before anything goes anywhere — is the right approach. Nothing unencrypted leaves your device.
## After Encryption: What to Check
After encrypting, verify the output:
1. Open the encrypted PDF in a reader and confirm it prompts for a password
2. Check the document properties (in most readers: File → Properties → Security) to confirm AES-256 is listed
3. Confirm the permissions you set are applied correctly
Takes 30 seconds. Worth doing.
[Encrypt a PDF now](/encrypt-pdf) — AES-256, in your browser, no upload.