Encrypt PDF: passwords, permissions and best results

What does Encrypt PDF do?

Encrypt PDF puts a password on your PDFs on your own computer, so only the people you choose can open them. It can also limit what readers may do once a file is open, such as printing or copying text. In the app the tool is called Encrypt.

It takes PDF files and gives back one protected copy of each. Every file in a batch gets the same passwords and the same permissions. Your originals are left untouched.

01Step 1: Add your PDFs

Click Tools in the sidebar, open the PDF tab and click Encrypt in the Protect section. You can also type "encrypt pdf" or "password protect" in the search box at the top.

Drop your PDFs on the queue, or click it to pick files. Add as many as you like: every file is protected with the same settings, one after another. To add more later, use Add more. Files that are not PDFs are set aside and skipped.

1234

1. 1Owner password
2. 2User password
3. 3Permissions
4. 4Run encrypt

04Step 4: Run, then check the result

Check where the files will go: Default output folder saves them in your workspace's output folder, in an encrypt folder with a subfolder for today's date, such as 10-15. Click Change to pick another folder for this run. Then click Run encrypt.

Each protected copy ends in -protected, so price-list.pdf becomes price-list-protected.pdf. When the run ends, every row shows Done, and Open folder takes you to the copies.

1234

1. 1Done
2. 2View
3. 3Saved to
4. 4Open folder

Before you send anything, open one copy in your usual PDF reader and type the password, so you know it works. Hangar's View cannot show a copy that needs a password to open. For more on reading results, see See and compare your results.

Every setting

All settings are in the Encrypt settings panel. There are no presets.

Owner password (required)

Protects the permission settings. Needed to run. Also opens the file.

• DefaultEmpty

User password (optional)

The password people type to open the file. Leave it blank to let anyone open it.

• DefaultEmpty (opens without a password)

Allow printing

Lets readers print the document. Turn it off to block printing.

• DefaultOn

Allow copying text

Lets readers select and copy text and images. Screen readers can always read the text.

• DefaultOn

Allow editing

Lets readers change the content and add, remove or rotate pages.

• DefaultOn

Allow annotations

Lets readers add comments and fill in forms.

• DefaultOn

Which protection do I need?

There are two kinds of protection, and they are not equally strong.

• A user password keeps people out. Without it, nobody can open the file or read its contents. Use one for anything private, such as contracts, statements or personal data.
• Permissions are a request, not a lock. When the user password is blank, the file opens for anyone and the permission switches ask the reader app to block printing, copying or editing. Most PDF readers respect them, but the panel itself warns that some readers don't, and they can be removed without any password, for example with Unlock PDF. Use permissions to discourage casual copying, not to protect secrets.

A good password is long and hard to guess. A short phrase of three or four unrelated words is easier to remember than a jumble of symbols and much harder to guess than a single word. Send the password separately from the file, for example by text message if you emailed the PDF.

If a file fails

A file that fails shows the reason under its row and in the What failed box. The usual messages are:

• "This file is password-protected": the PDF already asks for a password to open. Remove it with Unlock PDF, then encrypt the unlocked copy.
• "Couldn't read the PDF": the file is damaged or is not really a PDF. Open it in your PDF reader to check, or export it again from the app that made it.
• "Owner password is required": the owner password was empty. Fill it in and run again. In a chain, the Run screen asks for it before the chain can start.

If Run encrypt stays grayed out, fill in the owner password. A file failed: what to check lists more causes and fixes.

Limits

• Encrypt PDF accepts PDF files only.
• PDFs that already need a password to open are refused. A PDF that opens freely but has its own restrictions is accepted, and your new passwords and permissions replace the old ones.
• All files in a run share the same passwords and permissions.
• Permissions without a user password can be ignored by some apps, as explained above.
• Once a copy is encrypted, other PDF tools in Hangar, such as Compress PDF, refuse it. Do all your other changes first and encrypt last.
• Everything runs on your computer. Nothing is uploaded.

Use Encrypt in a chain

Encrypt is available as a step in chains, under the PDF steps, with the same permission switches as the tool. A common chain adds page numbers, compresses each PDF and then encrypts it, so every file is ready to send.

Always put Encrypt last, because the steps after it cannot open a locked file. Passwords are not saved with the chain: the step shows them as asked at run. Each time the chain runs, you type them on the Run screen, under the Encrypt step. Run chain stays grayed out until the owner password is filled in, and the hint names the step, for example "Enter the owner password for step 3 to run." Leave the user password blank there and the PDF opens without one. To run the same chain on new files each week, see Run a chain on many files.