Is RC4-40 encryption safe?

It is a legacy standard supported by every PDF reader. For everyday sharing it is a practical lock. For highly sensitive documents, use stronger AES-based protection or an additional secure channel.

What happens if I forget my PDF password?

The file cannot be recovered — there is no backdoor and no recovery service that can honestly help. Save the password in a password manager before protecting the document.

Does the Paperly Protect tool also prevent copying and printing?

It sets permissions that restrict copying and printing for password holders without owner rights. Note that permission restrictions are advisory — a determined user with the open password may still extract content through other means.

Is my password sent to a server?

No. Protect and Unlock both run in your browser; the password and file never leave your device.

Can I unlock a PDF I did not protect?

Yes, if you have the correct password or are otherwise authorized. The tool removes the password so the file can be opened freely.

What is the difference between Protect and Unlock?

Protect adds a password to a plain PDF. Unlock removes the password from an encrypted PDF (with the correct password). They are inverse operations sharing the same local encryption engine.

PDF passwords and encryption: what protection does and does not do

Guide · Updated 2026-08-12 · Security cluster

Password protection locks a PDF so it requires the password to open. Paperly uses the classic RC4-40 encryption that every PDF reader supports. It is a practical lock for everyday sharing — not unbreakable encryption, and the password cannot be recovered if forgotten.

Password-protecting a PDF is one of the most common things people ask PDF tools to do — and one of the most misunderstood. A password makes opening a file harder, but it is not a guarantee of absolute secrecy, and it does not protect metadata the way many people assume.

This guide explains what PDF encryption actually does, the difference between a user password and a permissions password, how the Paperly Protect and Unlock tools work, and where the honest limits are. Everything here is processed in your browser — no file or password ever leaves your device.

What password protection actually does

When you protect a PDF, the document contents are encrypted and the file becomes unreadable without the password. A PDF reader (Adobe Acrobat, the browser, your phone) will prompt for the password before showing anything. That is the core promise, and it works across every mainstream reader because the encryption method is a standard.

Honest limit: encryption protects the file at rest. It does not protect you from your own mistakes (a weak password), and it cannot stop someone who already has the plaintext from sharing it. No tool can do that.

User passwords vs permissions passwords

PDF security has two layers, and they are frequently confused:

Type	Controls	Example
User (open) password	Whether the file can be opened at all	A contract only you and a colleague can open
Permissions (owner) password	What a password holder may do with the document	Restricting copy, print or edit for people who can open it

The Paperly Protect tool applies a user password: the document requires the password to open. Permissions that restrict copying and printing are also set, so a password holder cannot trivially copy the text. The owner password that would lift those restrictions is tied to the same key — if you lose the password, those settings cannot be changed later.

How PDF encryption works: RC4-40 vs AES

PDFs can be encrypted with different algorithms, and the choice is a trade-off between compatibility and strength:

Algorithm	Strength	Compatibility	Used by Paperly?
RC4-40 (Standard security)	Legacy, short key	Every PDF reader ever made	Yes
AES-128 / AES-256	Modern, much stronger	Readers from roughly the mid-2000s onward	No (planned)

Paperly uses RC4-40 because it is the one encryption every PDF reader supports — old desktops, new phones, browser viewers and office suites alike. That universal compatibility is why the protected file opens anywhere. The cost is that RC4-40 is not modern-grade encryption. For genuinely sensitive material, treat it as a practical lock and consider a stronger solution or additional protection.

How to protect a PDF step by step

Open the Protect PDF tool.
Upload the PDF (up to 100 MB, processed locally).
Enter a password of at least 4 characters. Store it somewhere safe — it cannot be recovered.
Click Process. The encryption runs in your browser.
Download the protected PDF and try opening it in a normal reader to confirm the password works.

There is no way to recover a forgotten PDF password — not here, not on any honest tool. If you lose it, the file stays locked. Save the password before you close the tab.

How to unlock a PDF you are authorized to open

Unlocking is the reverse operation: you provide the password, and the tool produces a plain, unencrypted copy. The Paperly Unlock PDF tool does this entirely in your browser — the password and file never leave your device.

Open the Unlock PDF tool.
Upload the password-protected PDF.
Enter the password when prompted.
Click Process — a friendly error appears if the password is wrong.
Download the unlocked PDF.

Unlock only works with the correct password, by design. Paperly will not and cannot bypass encryption without it — any tool that claims to "crack" PDFs is either dishonest or exploiting a weakness you should not rely on.

What password protection does NOT do

It does not remove the password for you later without the password — that is the point of encryption.
It does not protect metadata automatically. Hidden document properties (author, title, dates) can still be visible in some viewers even when the content is locked.
It does not stop screenshots or photographing the screen — once someone can view the document, they can capture what they see.
It does not protect a file you have already shared in plaintext. Encrypt the original, then share the encrypted copy.
It is not a guarantee of absolute security. RC4-40 is a practical lock for everyday sharing, not military-grade encryption — and we do not claim otherwise.

Best practices for PDF passwords

Use a password you do not use anywhere else — a reused password leaks everything it protects.
Prefer long passphrases over short ones with symbols; length beats complexity for everyday documents.
Save the password in your password manager before downloading the protected file.
Protect the original, then share only the encrypted copy. Do not email both.
For genuinely sensitive material, consider end-to-end encrypted sharing or strong AES encryption in addition to a PDF password.

How to check whether a PDF is already protected

Before protecting a file, it helps to know its current state. Most readers show a lock or security indicator: Adobe Acrobat shows a lock icon and a Security panel; browser viewers typically show a padlock in the toolbar when a PDF is encrypted. The file itself also refuses to open in a reader without a password — the clearest signal of all.

If a file is already protected and you want to change the password, unlock it first with the current password, then protect it again with the new one. Protecting an already-encrypted file without unlocking first will not change the existing password.

Sharing a protected PDF safely

Send the password through a different channel than the file — email the PDF, and share the password by phone or a separate message.
Never email both the file and the password together; that defeats the lock.
If you share the file with several people, use a separate password per group so one leak does not expose everything.
Prefer a fresh protected copy for each share — do not reuse one encrypted file across contexts with different trust levels.
Revoke access by sharing a new encrypted copy with a new password when a recipient should no longer have access; PDF passwords cannot be revoked remotely.

Common mistakes

Using "password" or your own name — the most common, most easily guessed choices.
Forgetting the password — there is no recovery, and the document becomes permanently unreadable.
Protecting only the copy, then sending the unencrypted original to someone else.
Believing a PDF password equals full anonymity — it protects the file, not your identity.
Assuming Maximum-compressed or unlocked copies keep the same protection — once a file is unlocked or re-saved, its protection is whatever the new file has.

Troubleshooting

The protected PDF will not open with my password

Check for extra spaces or wrong keyboard layout. Passwords are case-sensitive and match exactly. If you truly cannot open it and you never saved the password, the file cannot be recovered — that is encryption working as intended.

A reader says the file is corrupted

Some older readers choke on files protected by tools they do not recognize. Open it in a current reader (Adobe, a modern browser, your phone). If it still fails, the original file may have been damaged before protection — try protecting a fresh copy.

The password is rejected even though I am sure it is right

Confirm the file you are opening is the encrypted copy and not the original. If you protected a file and later re-saved or converted it in another tool, that tool may have stripped the encryption.

I want to remove the password from a file I own

Use the Unlock PDF tool with the correct password. The output is a plain PDF with no password — keep it safe, because it is now readable by anyone.

Privacy and security model

Both Protect and Unlock run entirely in the browser. The password and the file bytes never leave your device — there is no upload, no server, no log entry containing your document. That is the strongest privacy posture a web tool can offer, and it is why the encryption key never passes through a third party.

Limitations

Encryption is RC4-40 (Standard security) — universal compatibility, not modern-grade strength.
Minimum password length is 4 characters; longer is strongly recommended.
Passwords cannot be recovered — losing one locks the file permanently.
File size limit is 100 MB per PDF.
Unlock requires the correct password; bypassing encryption is not supported, by design.

Frequently asked questions

Not with an honest tool. Paperly processes encryption locally and will not bypass it. Claims of "cracking" PDFs rely on weak encryption or dishonest marketing — treat them with suspicion.