How to password-protect a PDF: what RC4 encryption actually protects (and what it does not)
Password protection is the first thing people reach for when a PDF needs to stay private. It is also one of the most misunderstood features: many users believe a password makes a PDF "unbreakable", when in reality the strength depends entirely on the encryption algorithm and the password itself.
This guide explains honestly how the Paperly Protect tool encrypts files, what its limits are, and what to do when your documents need stronger protection. The encryption runs entirely in your browser — the password is applied locally and never transmitted.
What password protection actually does
Protecting a PDF encrypts the document streams and requires a password to decrypt and open them. Without the password, a PDF reader cannot render the content. The protection is written into the file itself, so it travels with the PDF wherever it is sent.
The honest limits of the encryption used
The Paperly Protect tool uses RC4-40, a legacy algorithm from the early days of PDF encryption. It was chosen for one reason: compatibility. Old PDF readers and many office suites open RC4-40 files without complaint, while modern AES-256 files can be rejected by older software.
Choosing a strong password
Encryption strength is only as good as the password. A short, guessable password defeats even strong encryption. Use a long passphrase — several unrelated words or a random string of 12+ characters — and store it somewhere safe, because a forgotten password means the file is permanently unreadable. There is no recovery mechanism.
How to protect a PDF step by step
- Open the Protect PDF tool.
- Upload the document.
- Enter a strong password (twice, to catch typos).
- Process — the file is encrypted locally in your browser.
- Download the protected PDF and test opening it with the password.
When protection is not enough
- Emailing the password in the same message as the file — a determined reader sees both.
- Documents that must meet compliance standards — many require AES-256, which this tool does not provide.
- Files already leaked — encryption protects the file, not copies already shared.
Privacy of the password
Because protection happens in your browser, your password is applied locally and never transmitted anywhere. There is no server that could log it, and no database that stores your files. The encrypted PDF you download is the only copy.
This on-device model removes an entire class of risk. A server-based protector would have to receive the file, encrypt it, and return it — every step of that path is a place where the document or the password could be intercepted, logged or retained. With local encryption, the strongest security practice is simply: use a strong password and store it safely, because neither the file nor the key ever leaves your machine.
Protection for different use cases
Password protection fits different documents differently. A personal tax return needs protection against casual readers and shared computers. A draft contract sent for review may only need protection for the journey between sender and recipient. A publicly distributed brochure should usually have no password at all, since a password that everyone must be given defeats the purpose of publishing.
- Personal documents — protect before storing on shared drives or emailing.
- Work-in-progress — protect to control access until the document is final.
- Public documents — usually no password; protection would only annoy readers.
- Compliance-bound documents — check the required standard; this tool may not meet it.
Combining protection with other security tools
A password protects the file, but it does not clean it. Documents routinely carry hidden metadata — author names, edit histories, timestamps — that can reveal more than the visible pages. Run the Metadata Cleaner before protecting to strip that information, and the Privacy Scanner to audit what remains. Protection and cleaning are complementary: the password stops people opening the file, while cleaning removes the details that would leak even from an open copy.
How to verify a protected PDF
- Download the protected PDF.
- Open it in your PDF reader — it should ask for the password.
- Enter the password and confirm the document opens.
- Close and reopen to confirm the protection sticks.
This quick verification catches typos in the password while you can still fix them. A protected file with a mistyped password is, from the outside, identical to one with the right password — only the test of opening it tells the difference.