To password protect a file properly, you need encryption with a password to open it: PDF files use AES-256, Word, Excel and PowerPoint files use Office's Agile Encryption (AES-256 in current versions), and ZIP archives should use AES-256 rather than the weak ZipCrypto scheme. Permission settings such as a PDF owner password, Word's Restrict Editing or Excel's Protect Sheet are not encryption and are easy to remove. With modern encryption, the strength of the protection depends almost entirely on the strength of your password.
- Only a "password to open" encrypts the content; editing and printing restrictions are flags that software can ignore.
- PDF AES-256, Office Agile Encryption and ZIP AES-256 are all strong when paired with a long, unique password.
- ZipCrypto is weak, and a standard encrypted ZIP still shows the names of the files inside.
- Send the password through a different channel from the file, never in the same email.
- A forgotten password cannot be recovered or reset; the only way back in is guessing it.
"Password protected" is used loosely for several very different things. Some protections make a file mathematically unreadable without the password; others merely ask well-behaved software to disable a few buttons. Knowing which one you are using is the most important part of protecting a document.
Password to open vs restrictions
A password to open encrypts the file's contents with a key derived from the password. Without the password, the data is meaningless bytes, and no software can display it. This is real protection.
Restrictions or permissions are different. The file opens normally for anyone, but the creator has asked for certain actions to be blocked. These are enforced by the application, not by mathematics, so they stop casual changes rather than a determined person:
- PDF permissions (owner password). A PDF can carry a second, owner password that controls printing, copying and editing. If the file has no open password, anyone can read it, and many tools ignore or remove the permission flags. Even with an open password, the flags only hold as long as the viewer honours them.
- Word Restrict Editing. Limits changes to tracked changes, comments or form filling. The document itself is not encrypted.
- Excel Protect Sheet and Protect Workbook (structure). Lock cells or stop sheets being added, deleted or renamed. They prevent accidents in shared spreadsheets but are not a security boundary; the data can still be read.
- Mark as Final and read-only recommended. These are polite notices that any user can dismiss.
Use restrictions to prevent mistakes. Use a password to open whenever the content is confidential.
How strong the encryption is
| File type | Encryption with password to open | Hides file names or metadata? | Notes |
|---|---|---|---|
| AES-256 (PDF 2.0, security handler revision 6) | Content encrypted; the file name of the PDF itself is not | Older PDFs may use RC4 or AES-128; re-protect them with AES-256 | |
| Word, Excel, PowerPoint (.docx, .xlsx, .pptx) | Agile Encryption (ECMA-376), introduced with Office 2010; AES-256 in current versions | The whole document package is encrypted | Very old .doc and .xls files used much weaker schemes |
| ZIP (AES-256) | AES-256 per file | No: names, sizes and dates stay visible | Windows File Explorer cannot open AES-encrypted ZIPs |
| ZIP (ZipCrypto) | Legacy stream cipher | No | Weak; vulnerable to known-plaintext attacks |
| 7Z | AES-256 | Yes, with header encryption enabled | Needs 7-Zip or a compatible tool to open |
AES-256 itself has no practical attack. What attackers do instead is guess passwords. They copy the file and try candidates offline as fast as their hardware allows, with no lockout after a few wrong attempts. Office and modern PDF encryption slow this down by deriving the key through many rounds of hashing (Office's Agile Encryption hashes the password 100,000 times by default), but no amount of slowing down saves a password such as Summer2024, which appears early in every guessing list.
ZipCrypto is weaker in a more fundamental way: if an attacker knows part of the content of one file in the archive, for example a standard file header, the keys can be recovered regardless of how good the password is. Use it only when the recipient can open nothing else and the content is not truly sensitive. For more on archive formats, see our comparison of ZIP vs RAR vs 7Z.
Choose a password that resists guessing
- Length matters most. A passphrase of four or five random words, or a random string of 16 or more characters, is far beyond offline guessing.
- Make it random and unique. Names, dates, keyboard patterns and passwords you use elsewhere are tried first. Leaked passwords from other sites are in every attacker's list.
- Let a generator do it. Our password generator creates long random passwords locally in your browser.
- Store it in a password manager so that a long, random password is not a burden.
How to password protect a PDF
- Open our Protect PDF tool and drop the file onto it.
- Enter a strong password to open the document.
- Optionally set an owner password and choose whether readers may print, copy text or edit.
- Click Protect PDF and download the encrypted copy. Open it once to confirm the password works, then delete any unprotected copies you no longer need.
In desktop software, Adobe Acrobat Pro (the paid version) offers password protection through its Protect tool, while the free Acrobat Reader cannot add passwords. LibreOffice can encrypt when you use File > Export as PDF and set passwords on the Security tab, and macOS Preview can add a password when exporting a PDF. To remove a password you know, use Unlock PDF; it also strips printing and copying restrictions from files that open without a password.
How to password protect Word, Excel and PowerPoint files
With our tools, choose Protect Word, Protect Excel or Protect PowerPoint, then:
- Drop the .docx, .xlsx or .pptx file onto the tool.
- Enter the password and click the protect button.
- Download the encrypted file. Word, Excel or PowerPoint will ask for the password when it is opened.
In Microsoft Office for Windows the steps are the same in each application:
- Open the file and go to File > Info.
- Click Protect Document (Word), Protect Workbook (Excel) or Protect Presentation (PowerPoint).
- Choose Encrypt with Password, type the password, confirm it and save the file.
Make sure you choose Encrypt with Password, not Restrict Editing or Protect Current Sheet, which do not encrypt anything. To remove the password later, repeat the steps, clear the password box and save. Our Unlock Word tool and its Excel and PowerPoint equivalents do the same in the browser when you enter the current password.
How to password protect a ZIP or any other file
Many files, such as images, videos and CAD drawings, have no password feature of their own. The standard answer is to put them in an encrypted archive:
- Open Password Protect Any File and add the files or folders.
- Enter a password and keep the default AES-256 encryption.
- Download the encrypted ZIP and send it. The recipient will need 7-Zip, WinRAR or another archiver that supports AES.
To add a password to an existing archive, use Protect ZIP; to remove one you know, use Remove ZIP Password. In 7-Zip, choose Add to archive, enter a password and select AES-256 as the encryption method. If file names are themselves sensitive, choose the 7z format and tick Encrypt file names. Be aware that Windows File Explorer cannot create encrypted ZIPs, and the zip -e command on macOS and Linux uses the weak ZipCrypto scheme.
How to share the password safely
Encryption is pointless if the password travels with the file. Anyone who intercepts or is wrongly forwarded the email gets both.
- Use a different channel. Send the file by email and the password by text message, phone call or a messaging app.
- Agree on it in advance for regular exchanges, so no password needs to be sent each time.
- Use a password manager's sharing feature where both people use one.
- Do not reuse the password across different files or recipients.
Some corporate email systems block or quarantine encrypted attachments because their virus scanners cannot look inside. If a recipient says the file never arrived, that is a likely cause, and a secure file-sharing service may work better.
If you forget the password
There is no back door and no reset link. Real encryption works precisely because nobody, including the software maker, can decrypt the file without the password. The only option is to guess, which works only if you remember most of the password. Unlock tools, including ours, require the correct password; they remove protection, not bypass it. The exception is restrictions without an open password, which can be removed because nothing was encrypted in the first place. Before encrypting anything important, store the password somewhere safe and keep an unencrypted copy in a secure location if losing access would be costly.
Frequently asked questions
Is a password-protected PDF secure?
If it has a password to open and uses AES-256, yes, provided the password is long and random. A PDF that opens without a password but blocks printing or copying is not secure; those restrictions can be removed easily.
Can Excel's Protect Sheet stop someone reading my data?
No. Protect Sheet stops cells being edited in Excel, but the workbook is not encrypted. Use File > Info > Protect Workbook > Encrypt with Password to require a password to open it.
Why can't the recipient open my password-protected ZIP in Windows?
Windows File Explorer only supports the old ZipCrypto scheme. AES-256 ZIPs need 7-Zip, WinRAR or a similar tool. Ask the recipient to install one rather than falling back to weak encryption for sensitive files.
Can I recover a forgotten Word or PDF password?
Not by any official route. The file can only be opened by guessing the password, which is realistic only for short or predictable ones. That is also exactly why a strong password protects you.
Is it safe to use an online tool to encrypt files?
It depends on where the processing happens. Our protect and unlock tools run entirely in your browser, so the files and passwords are not uploaded. With any service that uploads files to a server, you are trusting that server with the unencrypted document.