Why password-protect a PDF?

PDFs circulate easily: by email, USB stick, cloud. Without protection, anyone can open it, read it, modify it or redistribute it.

Password protection addresses several goals:

  • **Confidentiality**: only the legitimate recipient can read the document.
  • **Integrity**: the document cannot be modified without the password.
  • **Control**: you decide who can print, copy text or extract pages.

PDF encryption standards

PDF supports several encryption algorithms. Historically there have been many, but two dominate today.

RC4 (40 to 128 bits)

RC4 is a stream cipher developed in the 1980s. It was long used in PDFs and SSL connections.

Advantages: fast, supported by all PDF readers, even old ones.

Limits: RC4 is now considered weak. Vulnerabilities have been found, allowing the key to be recovered under certain conditions. It should no longer be used for strong protection.

AES-128 (Advanced Encryption Standard, 128 bits)

AES-128 is a block cipher standard adopted by NIST in 2001. It is used by governments, banks and enterprises to protect sensitive data.

Advantages: robust, globally recognized, still considered safe.

Limits: supported by most recent PDF readers, but not very old ones. Slightly slower than RC4 (imperceptible in practice).

What about the 256-bit AES variant?

You may have heard of the 256-bit AES variant, considered the gold standard. To be clear: IWELAH's PDF protection tool uses RC4 or AES-128 depending on your browser, never AES 256 bits.

This variant exists and is more robust, but not all PDF readers support it, and its integration in a browser remains complex. AES-128 already provides a level of security largely sufficient for most uses.

What is rasterization?

Beyond encryption, IWELAH applies a second protection: rasterization. Your PDF pages are converted to images, then reinjected into a new PDF.

Consequences:

  • **Text is no longer selectable**: impossible to copy-paste content.
  • **Metadata is lost**: author, keywords, revisions disappear.
  • **File is heavier** but safer.

Some users may find this limitation annoying. But it ensures that even if someone cracks the password, they cannot easily extract text as with a classic PDF.

How to protect a PDF: procedure

  1. **Open the Protect PDF tool** in your browser.
  2. **Drop your file** in the designated area.
  3. **Enter a strong password** (at least 12 characters, mix of letters, digits and symbols).
  4. **Click Process**. Processing happens locally.
  5. **Download** the protected PDF.

No file is sent to a server: everything happens in your browser.

Choosing a good password

A weak password cancels all encryption benefits. Here are the rules:

  • **Minimum length**: 12 characters, ideally 16.
  • **Diversity**: lowercase + uppercase + digits + symbols.
  • **No dictionary word**: "sunshine2026" will be cracked in seconds.
  • **No personal data**: birthday, child's name, etc.
  • **Unique**: never reuse a password used elsewhere.

Good practice: use a passphrase. "MyCatEats3MicePerDay!" is both long and easy to remember.

Transmitting the password securely

Protecting the PDF is not enough if you send the password in the same email. Use separate channels:

  • **Email for the PDF**, **SMS for the password**
  • **Sharing platform for the PDF**, **phone call for the password**
  • **Password manager** with secure sharing feature

Mistakes to avoid

1. Using too simple a password

Already mentioned, but this is the first cause of leaks.

2. Sending password and PDF together

If the email is intercepted, everything is compromised.

3. Believing the PDF is unbreakable

No encryption is eternally safe. For very long-lived documents, reassess periodically.

4. Forgetting the password yourself

Save your passwords in a manager. No recovery is possible on an encrypted PDF.

Special cases

Invoice PDFs sent to a client

A simple password usually suffices. The goal is to prevent reading by an intermediary, not to resist a targeted attack.

Medical documents

Use AES-128 with a strong password, transmitted separately. Confidentiality is critical here.

Commercial contracts

Also consider a qualified electronic signature, which guarantees the signer's identity.

Conclusion

Password-protecting a PDF is a simple operation that brings real added value in terms of confidentiality. The key is understanding that encryption is only part of the solution: password choice, secure transmission and general caution do the rest.

IWELAH uses RC4 or AES-128 depending on your browser, with page rasterization to prevent text selection. This is a reasonable compromise between security and compatibility.

Try the Protect PDF tool to see the concrete result.