🔑 Set PDF Permissions

Control exactly what users can do with your PDF. Granular permission flags for printing, copying, editing, annotating, form filling, and assembly — with AES-256 encryption.

Select or drop your PDF file here

document.pdf

Loading…

Permission flags are applied in your browser with AES-256 encryption. Your PDF never leaves your device.

Owner Password (Required)

Owner Password Required to change permissions later

This password unlocks all restrictions. Keep it safe — it cannot be recovered.

Open Password Optional — leave blank for open access

If left blank, anyone can open the PDF — but permissions still apply.

Permissions

Allow Printing

User can print the document.

Allow Copying

User can select and copy text and images.

Allow Editing

User can modify content and pages.

Allow Annotating

User can add comments, highlights, and notes.

Fill Form Fields

User can fill in and sign PDF forms.

Screen Reader Access

Allow text extraction for accessibility tools.

Document Assembly

User can insert, rotate, or delete pages.

File Info

Filename —

Size —

Pages —

Allowed All (7/7)

Quick Presets

Compatibility

Adobe Acrobat, Reader DC, Foxit

Chrome, Firefox, Safari, Edge

macOS Preview, iOS Books, Android PDF apps

Permissions are advisory — determined users can bypass them. The owner password is what actually protects the content.

Your PDF never leaves your browser. 100% private and secure.

How to Set PDF Permissions

Upload PDF

Drop your PDF above or click to browse. Your file never leaves your device.

Choose Permissions

Toggle the seven permission flags or pick a preset. Set the owner password.

Apply & Download

Click "Apply Permissions" — your permission-restricted PDF saves instantly.

Frequently Asked Questions

What's the difference between owner password and open password?

Owner password (required) unlocks all restrictions. Whoever knows it can change permissions, print, copy, and edit without limit. It's the "master key" for the document.

Open password (optional) is required just to open the PDF. If set, users must enter it before they can view the document. If left blank, anyone can open the PDF — but the permission flags still apply.

Are PDF permission flags really enforceable?

Partially. Mainstream PDF readers (Adobe, Foxit, Chrome, Safari, Preview) respect the permission flags — they grey out "Copy" in the menu, disable "Save As", and block text selection. However, permission flags are not cryptographic: a determined person with a tool like qpdf or pdftk can remove them without knowing the owner password.

The owner password is what actually protects the content — that's mathematically solid. Treat permission flags as strong deterrence for casual users, not as absolute control.

What do the seven permission flags do?

Printing — allow or block printing (high or low quality).

Copying — allow or block text/image selection and clipboard copy.

Editing — allow or block content modification.

Annotating — allow or block adding comments and highlights.

Fill Form Fields — allow or block filling in interactive forms.

Screen Reader Access — allow or block text extraction for accessibility tools (recommended ON).

Document Assembly — allow or block inserting, rotating, or deleting pages.

Can I set permissions without setting an open password?

Yes. Leave the "Open Password" field blank. The PDF will open without a password prompt, but the permission flags still apply — for example, "no copying" will still prevent text selection in Acrobat. This is the most common use case: open access, restricted actions.

What happens if I forget the owner password?

You lose the ability to change permissions. The owner password is what unlocks the restrictions. Without it, no one can remove the permission flags through any tool that respects them. Keep your owner password safe — write it down in a password manager.

If you just want to remove permissions from a PDF you own, use the Unlock PDF tool — it accepts the owner password to strip all restrictions.

Is my PDF uploaded to a server?

No. Everything happens in your browser using @cantoo/pdf-lib. The owner password is used locally to derive the encryption key and never transmitted. You can verify this by opening DevTools → Network tab — zero outbound requests beyond the initial page load.