Direct answer: You can set PDF permissions online for free with the PDF Permissions tool: choose an owner password, which is required because it locks the rules, optionally add an open password, and allow or deny printing, copying, modifying, comments, and form filling. The rules are enforced with AES-256 encryption by the QPDF engine in your browser, and nothing is uploaded in the process.
The owner password is the key idea to grasp first. Without it, permissions would be a polite request that anyone could remove. With it, the rules are locked to that password: a reader without the owner password cannot legitimately change or remove them, while a reader with it can. Understanding that distinction before you set anything will save you from the most common permissions mistake, which is setting rules and then losing the password that controls them.
Owner password and open password: two different locks
The owner password is required, and it should be treated as the master key for the file's rules. It locks the permission settings themselves, so that printing, copying, and editing controls cannot be changed by someone who merely opens the document. If you later want to change or remove the permissions, you will need this password, and you can do so through an unlock workflow. Keep it somewhere safe and separate from the file, because losing it means you cannot legitimately change the rules you set.
The open password is optional and does something different: it controls whether the file can be opened at all. A reader without the open password cannot open the document, while a reader with it can open and read it, subject to the permissions you set. Use an open password when the document itself should be private, and leave it off when the document is meant to be readable by anyone who receives it but still subject to use restrictions, such as no copying or no printing. Mixing up the two passwords is the most common source of confusion, so decide before you start which kind of protection each recipient actually needs. A document that is meant to be read by a wide audience but not copied, for example a course handout, is a good candidate for an open-password-free setup with copying denied, because readers can open it freely while still being prevented from lifting its text by ordinary reader actions.
The permissions you can allow or deny
Printing can be allowed in full, limited to low-resolution printing at 150 DPI, or denied entirely. Full printing suits a document that recipients genuinely need on paper. Low-resolution printing is a useful middle ground for a draft or a preview copy: the reader can print a usable reference, but not a high-quality reproduction. Denying printing suits a document that should stay on screen, such as a confidential briefing that should not leave the office as a paper copy.
Copying text and images, modifying the document, adding comments and annotations, and filling form fields can each be allowed or denied separately. That granularity matters, because a single blanket setting rarely fits a real document. A form that recipients must complete needs form filling allowed, even if copying and modifying are denied. A report that recipients should discuss may need comments allowed, even if editing the text itself is denied. Think about what each recipient needs to do with the file, and allow exactly that, rather than allowing everything out of habit or denying everything out of caution.
| Permission | Options | Typical choice |
|---|---|---|
| Printing | Full, low-resolution 150 DPI, or none | Low-resolution for previews |
| Copying text and images | Allow or deny | Deny for confidential drafts |
| Modifying | Allow or deny | Deny for issued documents |
| Comments and annotations | Allow or deny | Allow for review copies |
| Filling form fields | Allow or deny | Allow for forms to complete |
Example: a typical review-copy permission set — hover or tap each bar for details.
Step by step: applying permissions to your PDF
Start with a copy of the document, and decide your passwords before you open the tool, because a password invented in a hurry is a password you are likely to forget. Choose an owner password that is strong enough to protect the rules, write it down in a safe place, and decide whether an open password is needed at all. Then load the PDF, set each permission deliberately, and double-check the combination before you apply it, because a form with filling denied by mistake is a form nobody can complete.
After applying the permissions, test the result as a recipient would. Open the protected copy without the owner password, and try the actions you intended to deny: attempt to print, copy text, and edit, and confirm that the reader blocks or limits them as expected. Then test the actions you intended to allow, especially form filling if the document is a form. That two-sided test, checking both the denials and the allowances, is what turns a setting you hope is right into a setting you know is right.
- Make a copy of the PDF and decide your passwords in advance.
- Set a strong owner password, which is required to lock the rules.
- Add an open password only if the file should not open without one.
- Set printing, copying, modifying, comments, and form filling one by one.
- Apply the permissions and download the protected copy.
- Test the copy as a recipient, checking both allowed and denied actions.
- Store the owner password safely, separate from the protected file.
Test both sides of every permission. A setting is only confirmed when the denied action is blocked and the allowed action still works, especially form filling on a form.
How AES-256 encryption works in your browser
The permissions are enforced through AES-256 encryption, applied by the QPDF engine running in your browser. Encryption is what gives the permission settings their force: the rules are not merely a note attached to the file, but part of a protected file structure that compliant readers respect. AES-256 is a widely used, strong encryption standard, and its presence means that the protection is not a cosmetic label that any viewer can ignore at will.
Running the engine in the browser has a practical privacy benefit: nothing is uploaded. The file, the passwords, and the permission settings stay on your device while the protected copy is built. That matters for confidential documents, where uploading to an unknown server would itself be a risk, even if the server promised to delete the file afterwards. As with any security tool, however, browser-side processing does not make the file magically safe in every situation, and the honest limits in the next section are part of using the tool responsibly. That browser-side approach also means that no copy of the protected file needs to be stored elsewhere to complete the task, and the downloaded protected copy is the only new file you need to manage, alongside the original unprotected copy kept separately for future edits.
Honest limits: what permissions cannot stop
Permissions are enforced by well-behaved readers, such as Acrobat, web browsers, and Preview, which respect the permission flags in a protected PDF. That covers the normal ways people open and use a document, and for most everyday sharing it is exactly the protection needed. A colleague opening the file in a standard reader will find printing, copying, or editing limited exactly as you set them, and will have no legitimate way around those limits without the owner password.
What permissions cannot stop is a determined person capturing what is on screen. Screenshots, photographs of a screen, and retyping visible text are outside the control of any PDF permission setting, because they do not rely on the PDF reader's permission enforcement at all. That limit is not a flaw in this tool; it is a property of all PDF permissions everywhere. If a document must never be seen by a particular person, do not send it to that person at all, and if it must never be copied in any form, treat permissions as a deterrent and a statement of intent, not as an absolute barrier. For content that must genuinely disappear from a file, rather than merely be restricted, read our guide to permanently removing sensitive content from a PDF, and see other PDF guides on the main blog listing.
Changing or removing permissions later follows the same logic. With the owner password, you can change or remove the permissions through an unlock workflow and issue a new copy with new rules. Without the owner password, you cannot legitimately change them, which is precisely the protection the owner password provides. That is why storing the owner password safely is not an administrative detail, but the core of the whole system: lose it, and the rules you set become permanent in practice, even for you.
Protect yours now with the free PDF Permissions tool, explore more guides on Asad Webs blog posts, or contact Asad Webs if you need help securing documents for your business.
Frequently Asked Questions
What is the difference between the owner password and the open password?
The owner password locks the permission rules themselves and is required. The open password is optional and controls whether the file can be opened at all. A reader with only the open password can read the file subject to your permissions, but cannot change those permissions.
Which permissions can I control?
You can allow or deny printing, with full, low-resolution 150 DPI, or no printing options, plus copying text and images, modifying the document, adding comments and annotations, and filling form fields. Each permission is set separately, so a form can allow filling while denying copying and editing.
How strong is the protection?
The rules are enforced via AES-256 encryption by the QPDF engine in the browser, which is a strong, widely used encryption standard. Compliant readers such as Acrobat, browsers, and Preview respect the permission flags in the protected file.
Is my file uploaded to a server?
No. The QPDF engine runs in your browser, so nothing is uploaded while the protected copy is built. The file and passwords stay on your device during processing, which suits confidential documents.
Can permissions stop screenshots?
No. Well-behaved readers enforce PDF permissions, but screenshots, camera photographs of a screen, and retyping visible text cannot be stopped by any PDF permission setting. Treat permissions as a strong control for normal reader use, not as an absolute barrier against determined copying.
Can I change or remove permissions later?
Yes, with the owner password, you can change or remove permissions later via Unlock PDF and issue a new copy. Without the owner password, you cannot legitimately change them, so store the owner password safely and separately from the file.
Is the tool free?
Yes, the tool is free to use. You can set an owner password, an optional open password, and each permission, and download the protected PDF without paying for the permissions features described here.
Be the first to share a useful question or thought.