Protect, Unlock & Compress PDF

about this tool

qpdf, in the page

This tool runs qpdf compiled to WebAssembly. It is the same program the command-line world uses for this job, so the encryption is a real implementation rather than something hand-rolled here — which matters, because a home-made cipher is the last thing anyone needs in a security tool. The 1.3 MB binary is served from this site and fetched the first time you run a job; your file goes into qpdf's own in-memory filesystem and comes back out again without touching a network.

The exact command being run is shown next to the options, with passwords masked, and can be copied — the same line works in a terminal.

Protect

Sets an open password, which is needed to read the file, and an owner password, which lifts the restrictions. Encryption is AES-256 at revision 6; the older RC4 modes are not offered, since they are broken.

The permission switches map onto the bits of the encryption dictionary's /P entry, described in PDF 32000-1 Table 22, and the resulting value is shown as you change them. That arithmetic is done here and checked against what qpdf actually writes, by encrypting a file in the test suite and reading the permissions back out of it.

Two honest warnings the tool will give you: with no open password anyone can read the file, and the restrictions are advisory — plenty of viewers ignore them. With the same password for both, anyone who can open the file can also lift the restrictions.

Unlock

Removes the encryption from a file you can already open, given its open or owner password. There is no way to unlock a file whose password you do not have. A file that is encrypted but opens without a password — the restrictions-only case — is detected when you drop it, and its permissions are listed.

Compress

Three independent things, all optional. Packing objects into object streams and recompressing every stream at maximum effort helps text-heavy files. Re-encoding images as JPEG is where the real savings are, and qpdf only does it where the result is actually smaller. Linearising rearranges the file so a viewer can show the first page before the rest arrives, at a small cost in size.

The result always says what happened, including when the file came out bigger — which is common for small files, where object stream overhead outweighs the gain.

Limits

Unlocking needs the password. Compression will not rewrite a scanned document as a smaller scan: for that, run PDF → Images at a lower dpi and then Images → PDF. Detecting whether a file is encrypted is done by looking for an /Encrypt entry in the bytes, because pdf-lib cannot always parse an encrypted file far enough to notice. Everything runs in your browser and nothing is stored between visits.

To check or change what a document says about itself before locking it, use PDF metadata. Compression here is lossless; for the images inside a scan, image compressor goes further.

questions

How strong is the protection?

AES-256 with revision 6, the strongest the PDF format defines and what qpdf writes by default at 256 bits. The file is genuinely encrypted, so its strength is the strength of your password. Older RC4 options are deliberately not offered.

What is the difference between the two passwords?

The open password is needed to read the file at all. The owner password lifts the restrictions — printing, copying and so on — for whoever has it. Setting only an owner password leaves the file readable by anyone, with restrictions that many viewers simply ignore, and the tool says so.

Can it remove a password I do not know?

No. Unlocking needs the password, either the open one or the owner one. There is no way around that, and anything claiming otherwise is either guessing passwords or lying.

How much smaller will my file get?

It depends entirely on what is inside. Packing objects together and recompressing streams helps text-heavy files a little; re-encoding images as JPEG is where the real savings are, and only happens where it actually makes an image smaller. Small files often come out slightly bigger, and the result says so plainly.

Is my file or my password uploaded?

No. qpdf is compiled to WebAssembly and runs inside the page, reading and writing in its own in-memory filesystem. The 1.3 MB binary is served from this site and fetched the first time you run a job. Nothing is sent anywhere and nothing is stored between visits.