Adding a password encrypts the PDF with AES-256, so it can't be opened without that password. Removing a password decrypts a file using the password you already know — it is not a way to recover or bypass a forgotten password. Both operations run locally in the browser via a WebAssembly build of QPDF.
How PDF password protection actually works
Adding a password to a PDF encrypts its content with a cipher — AES-256 here — so the file's contents are unreadable without supplying the correct password to decrypt it. This is real encryption, not a viewer-level lock: without the password, the underlying bytes are not just hidden, they're cryptographically inaccessible.
Removing a password does the reverse: it decrypts the file using the password you provide. This only works if you already know the password — there is no way to skip that step, because the whole point of the encryption is that it can't be reversed without it.
What a password does — and doesn't — protect against
A password stops the file from being opened at all without it, which protects a PDF in transit or storage from anyone who doesn't have the password. It does not add a technical barrier once the file is legitimately open: someone who has entered the correct password and is viewing the document can still select text, take a screenshot, or otherwise copy what's visible on screen, the same as any other opened document.
The encryption strength is only as good as the password protecting it. A short or guessable password undermines AES-256 the same way a flimsy lock undermines a strong door — the cipher isn't the weak point, the password usually is.
Done privately, in the browser
Both adding and removing a password happen through QPDF — an open-source PDF encryption tool — compiled to WebAssembly and run directly in your browser tab. Your file and password are read locally and never leave the page; you can confirm this yourself by checking your browser's Network tab while the file processes.
Limitations
This is a straightforward encrypt/decrypt operation, not a password-recovery service — if you don't know a PDF's current password, removing it isn't possible here (or, realistically, anywhere, without specialized and often slow brute-force tooling that AES-256 is specifically designed to resist).
Adding a password
Choose a real password, not a short or predictable one — it's the actual security boundary, not the encryption algorithm.
Removing a password
Enter the file's current password to decrypt it. This requires knowing the password already.
Store the password separately
Keep the password somewhere other than the filename or an accompanying note — an encrypted file next to its password defeats the purpose.
Frequently asked questions
What encryption does PDF password protection use?
AES-256, applied via the open-source QPDF engine compiled to run directly in the browser. The same standard is widely used for encrypting sensitive data generally.
Can I remove a PDF password without knowing it?
No. Removing a password requires the correct password as input — this is a decryption step, not a password-cracking or recovery tool. It only works on files you can already unlock.
Does a password stop someone from copying the visible text?
A password stops someone from opening the file at all without it. It does not add a technical barrier against someone who has already opened the PDF from selecting text, taking a screenshot, or otherwise copying visible content.
Is adding a password to a PDF done privately?
Yes. Encryption and decryption run locally via a WebAssembly build of QPDF — the file and password are never sent anywhere. You can confirm this in your browser's Network tab.
Primary reference
- NIST FIPS 197: Advanced Encryption Standard (AES) — the federal standard defining the AES cipher used for PDF encryption here.