Bảo vệ PDF

Công cụ này làm gì

Two different things are called protection, and a PDF offers both. A user password encrypts the file: without it the document cannot be opened by anyone, and that is real cryptography rather than a preference. The permission flags are not encryption at all - they record a request, such as do not print, that a well-behaved reader honours and any other reader may ignore.

Use the password before a document travels somewhere you do not control: a payslip going to a personal address, a contract sent to a counterparty, tax papers going to an adviser. Reach for the permission flags in the softer case, where a request is all you need and all you will get.

Cách hoạt động

1. Drop the PDF onto this page. A document that is already encrypted is refused rather than encrypted twice, because a doubly encrypted file is one no reader can open.
2. Type the password people will need in order to open it. This is the field that actually encrypts; everything below it is weaker.
3. Set a separate permissions password if opening the file and controlling it should be different privileges. Leave it empty and the open password is used for both.
4. Choose the encryption strength, then set the toggles for printing, copying, editing, annotating and form filling.
5. Press Protect PDF. The password is the only way back in, so keep it somewhere you will still have it next year.

The encryption is done by qpdf compiled to WebAssembly, running in a worker inside your browser. The password you type is used there to derive the file's key and is never transmitted - open the network tab, protect a document, and the one request you will find asks whether you have tasks left, carrying a tool name and a hash.

The two passwords do different jobs. The open password decrypts the file; the permissions password is what lets somebody lift the restrictions afterwards. qpdf needs a permissions password to set any restriction at all, so when only one box is filled in that password is used for both - one password that opens and fully controls the file.

Take the permission flags for what they are. Acrobat and most commercial readers honour them; plenty of free readers do not, and stripping them takes one pass through Unlock PDF and no password whatsoever. If a document genuinely must not be printed, the answer is not to send it.

AES 256-bit is the default because it is the strongest thing the format offers and every reader since roughly Acrobat 9 understands it. The 128-bit settings are compatibility choices for older software and are meaningfully weaker, RC4 especially. Whichever you pick, the length of your password matters more than the cipher, because the password is what gets guessed.