Set an open password and optional PDF permissions in your browser, then download a locked file. Nothing is uploaded — encryption runs only on this device.
Drop a PDF to lock with a password
or click to browse
Remember this password — VeloTools cannot recover it. Encryption runs only in this tab.
Defaults restrict copy and edit. Printing and form fill stay on unless you change them. Readers that respect PDF security will enforce these after the open password.
Your password is typed into this page and used only to derive the PDF encryption key in memory. The output file includes a Standard Security Handler /Encrypt dictionary. Neither the password nor the PDF body is posted to VeloTools servers.
| Operation | Write /Encrypt with user open password + separate owner password |
|---|---|
| Library | @cantoo/pdf-lib (encrypt-capable fork) |
| Cipher | Standard Security Handler — strength follows the source PDF version (often AES for modern files) |
| Permissions | User-configurable: print, copy, edit, fill forms |
| Already encrypted | Unlock first, then protect |
| Network | 0 bytes of PDF content leave the browser |
Protect sets a user (open) password so viewers must unlock the file before reading. A separate owner password is generated in the browser for permission enforcement and is never shown or stored — you only need the open password to view the file. Use the permission checkboxes to allow or deny print, copy, edit, and form fill.
To remove protection later, use Unlock PDF with the same open password.
Client drafts leave the machine with a password I set here — Standard Security Handler in the file, not a “secure link” on a stranger’s server. Remember the password; we cannot recover it because we never saw the file.