PDF Security Tools
Protect, unlock and secure your PDF documents.
Three different things get called securing a PDF: stopping the wrong people opening it, putting your signature on it, and removing a password from a file you are entitled to open. They are separate operations with separate risks, and it is worth being clear about which one actually solves your problem — encryption keeps a document shut, a signature says who agreed to it.
Which do you need?
- Protect PDF
- The document should not open without a password — payroll, medical records, anything with personal data.
- Sign PDF
- You need your signature on a contract, a form or an agreement before sending it back.
- Unlock PDF
- You have a password-protected file you are entitled to open and want to work with it without retyping the password every time.
Password protection is real encryption, and it depends entirely on the password
Protecting a PDF encrypts its contents with AES: without the password the file is unreadable, not merely inconvenient. That makes the password the whole security model. A short or guessable one can be brute-forced offline by anyone holding the file, and emailing the password in the same message as the document defeats the exercise entirely — send it through a different channel. It also means a lost password is genuinely lost: there is no recovery, no reset, and no back door, so store it before you close the tab.
What a drawn signature does and does not prove
Sign PDF places your signature onto the page as an image — the electronic equivalent of signing a printout and scanning it. That is what most everyday agreements ask for, and in the EU it counts as a simple electronic signature under eIDAS, admissible as evidence rather than automatically void. It is not a digital signature in the cryptographic sense: it does not carry a certificate, does not prove who applied it, and does not detect if the document is altered afterwards. For contracts requiring a qualified electronic signature, or where non-repudiation genuinely matters, you need a certificate-based service and a trust provider. For a rental agreement, a school form or an NDA, a drawn signature is normally exactly what is expected.
Unlocking removes a password you already have
Unlock PDF decrypts a document using the password you supply and saves an unencrypted copy — for when you are the legitimate holder and want to stop typing the password every time you open a bank statement, or need to merge a protected file with others. It cannot recover, guess or bypass a password you do not know: without the correct one, the contents cannot be decrypted at all. The obvious caution is that the result is a plain, readable file, so think about where that copy ends up. If it holds personal data, treat it the way you would treat the unprotected original.
Why doing this locally matters more here than anywhere else
These are exactly the documents you would least like to hand to a stranger's server: contracts, payslips, medical letters, identity papers. Everything in this category runs inside your browser — the encryption, the signing and the decryption all happen on your device, and neither your file nor your password is transmitted anywhere. There is no server-side copy, so there is nothing to be retained, leaked or subpoenaed.
Frequently asked questions
Can you recover a PDF password I have forgotten?
No. The file is encrypted, and without the password the contents cannot be decrypted. Unlock PDF removes a password you can supply — it does not crack one.
Is my signature legally binding?
A drawn electronic signature is accepted for most everyday agreements and, in the EU, is valid evidence under eIDAS as a simple electronic signature. Agreements requiring a qualified electronic signature need a certificate-based provider instead. If a specific legal standard applies, check what it demands.
Does protecting a PDF stop people copying the text?
Password protection controls opening the document. Permission settings can discourage printing and copying, but every viewer enforces those by convention rather than by cryptography, so treat them as a signal of intent rather than a guarantee.
Is my password sent anywhere?
No. Encryption and decryption happen in your browser. The password is used in memory on your own device and never transmitted.