discreetpdf.com

Protect a PDF

Drop a PDF, set a password, and download an encrypted copy. It's locked on your device, with no upload.

Files are processed entirely in your browser. Your file's contents never leave your device.

Your PDF never touches a server. There's nothing here to ration.

No daily caps. No spinner that turns into a paywall after the third file.

Private by architecture

Your PDF never leaves your device.

Unlimited use

No daily caps or hourly throttling. The heavier tools cap files at 100 MB.

No signup, no watermarks

Every tool below works with or without an account.

Works offline

A tool you've already loaded keeps working offline. Tools you haven't opened yet still need the network.

About this tool

Protecting a PDF puts a password on it, so anyone who opens the file has to type that password first. This is the natural thing to do before you email a contract, a medical result, a tax return, or a scan of your passport. It's also the file you'd least want to hand to some website to encrypt for you, which is the whole point here: the password and the document never leave your device. The encryption happens on your machine and the protected copy downloads straight back to you.

The lock itself is AES-256, the same encryption modern versions of Acrobat, Preview, and Chrome's built-in viewer expect, produced here by qpdf compiled to WebAssembly and running in a worker on your own device. If you need the file to open in an older reader, there's an AES-128 option that trades a little strength for wider compatibility. Either way the math runs locally, seeded by your browser's own secure random source, and nothing is uploaded to be scrambled.

One honest caveat worth stating plainly: there is no password recovery. If you forget the password you set, the file is not openable by anyone, because it never left your device and no copy is kept. Write it down somewhere safe. Your original file stays where it was; the protected version comes down as a separate copy so you always have the unlocked one to fall back on.

Frequently asked questions

Does my file or password get uploaded?
No, on both counts. qpdf, compiled to WebAssembly, builds the AES lock inside a worker in your tab, and the password only ever exists in memory long enough to do that. Watch the network panel before, during, and after: nothing carries your file or what you typed.
What encryption does it use?
AES-256 by default, which is the strong, current PDF encryption standard (revision 6). There is also an AES-128 option if you need the file to open in an older reader that predates AES-256 support. RC4 and 40-bit, both long broken, are deliberately not offered.
Will the protected PDF open everywhere?
AES-256 opens in Acrobat and Reader from 2017 on, current macOS Preview, Chrome and Edge's built-in viewers, and modern mobile readers. If you're sending to someone on much older software, pick AES-128 for the widest reach.
What if I lose the password?
Then the file can't be opened, and nothing can recover it. That's the trade for real encryption: the password isn't stored anywhere, including here. Keep a copy of it somewhere safe, and hold onto your original unprotected file.
Can I protect a PDF that already has a password?
Yes. Drop it in and you'll be asked for its current password so it can be opened locally first, then re-protected with the new password you choose. Nothing is uploaded during either step.

All PDF tools

All free, all in your browser. Pick the task you need.