Document scanning guide
How to Password-Protect a PDF on Your Phone
Lock a PDF with a password on Android or iPhone, choose a password that actually resists guessing, share it safely, and know what PDF encryption cannot do.
To password-protect a PDF on your phone, you need an app that can encrypt the file when it saves or exports it. The recipient then has to type the password before any PDF reader will show the pages. The protection is only as strong as the password you pick and the way you share it, so those two steps matter as much as the button you press.
Below we explain what a PDF password actually does, how to choose one, how to send it without undoing the protection, and how to lock a scan in a few taps.
What a PDF password actually does
PDF files support two kinds of password:
- An open password (also called a user password). Without it, the file cannot be opened at all. The content is encrypted, so it is not just hidden behind a prompt.
- A permissions password (also called an owner password). This one lets someone open the file but asks the reader app to block actions like printing, copying text or editing. These restrictions depend on the reader app respecting them, and many tools ignore them, so treat them as a polite request rather than security.
When people say they want to "password-protect a PDF", they almost always mean the first kind: nobody without the password can read the document. That is what this guide focuses on.
Encryption strength
Modern PDF encryption uses AES, either with a 128-bit or a 256-bit key. Both are far beyond what anyone can break by attacking the encryption itself. Older PDFs may use a cipher called RC4, which is considered weak, so avoid tools that only offer that. In practice, the weak point is never the key length. It is a short or guessable password, because an attacker with a copy of the file can try passwords offline, as fast as their hardware allows, without any lockout.
How to choose a password that holds up
Password strength is measured in bits of randomness: each extra bit doubles the number of guesses an attacker needs. Here is how some common choices compare, assuming each character or word is picked truly at random:
| Password style | Example shape | Approximate strength |
|---|---|---|
| 6 random digits | 482915 | about 20 bits |
| 8 random lowercase letters | qmvtrkeo | about 38 bits |
| 8 random letters and digits (upper and lower case) | t7Rk2mQa | about 48 bits |
| 4 random words from a 7,776-word list | maple-orbit-sugar-tundra | about 52 bits |
| 5 random words from a 7,776-word list | maple-orbit-sugar-tundra-velvet | about 65 bits |
| 12 random letters and digits | t7Rk2mQa9xLp | about 71 bits |
The jump from the 8-lowercase-letter password to the five-word passphrase is 27 bits, which means roughly 134 million times as many guesses. Some practical rules:
- Never use something tied to the document, such as your birthday, a policy number, a ZIP code or the recipient's name. Those are exactly what someone holding your file would try first.
- Use a passphrase of four or five random words when a person has to type it. It is long but easy to read out or type on a phone keyboard.
- Let a password manager generate it if you will paste it rather than type it.
- Use a new password for each file or recipient. If one leaks, the others stay safe, and you never have to reuse a password from another account.
Write it down before you export. There is no "forgot password" for an encrypted PDF. If you lose the password, the file cannot be opened, so keep the unprotected original somewhere private or store the password in your password manager.
How to share the file and the password
The single most common mistake is sending the password in the same email as the attachment. Anyone who gets into that inbox, or who receives a forwarded copy, gets both. Instead:
- Use a different channel for the password: a text message, a phone call, or a messaging app, while the PDF goes by email or upload.
- Agree on the password in advance for recurring exchanges, such as monthly documents with an accountant, and still change it from time to time.
- Do not put hints in the file name or subject line. "Statement - password is your postcode" undoes the protection.
What a PDF password cannot do
- It cannot control what happens after opening. Once the recipient opens the file, they can save, print, screenshot or forward the content. Password protection is about getting the file safely to the right person, not about controlling them afterwards.
- It does not hide everything about the file. The file name and size remain visible, and depending on the tool, some document properties may be too. Use a neutral file name.
- It is not a substitute for redaction. If the recipient should not see a number at all, remove it before you share. See how to redact a document before sharing it.
- It only covers PDF. Word documents and image files use different protection schemes. If you need to send images or several documents at once, an encrypted ZIP archive is one alternative, but some built-in unzip tools cannot open AES-encrypted ZIP files, so check that the recipient has an app that can.
Password-protecting a PDF in OnlyScans
OnlyScans can encrypt a PDF as part of export, so you can scan a paper document and send a locked file in one go. Password export is a Pro feature on both Android and iPhone. On Android:
- Open the document and tap Export.
- Under Format, choose PDF Document. Passwords are offered only for PDF.
- Open Advanced options and turn on Password protect ("Require password to open").
- Type the password in the Password field. Tap the eye icon to show it and check for typos.
- Tap Export PDF, then share, print or save the file.
On Android, OnlyScans encrypts the PDF with AES using a 128-bit key and sets the same password for opening and for permissions, so the file opens fully for anyone who has the password. AES-128 is supported by mainstream PDF readers on phones and computers. After writing the file, the app reopens it with your password to confirm the encryption is in place before handing it over. The iPhone version has the same Password protect switch on its export screen.
If you select several documents in the library and export them together, you can bundle them as a single ZIP archive and turn on Password protect for the archive, which uses AES encryption. That is handy for sending a whole set, such as a month of receipts, in one locked file.
It works the other way, too. If you import a password-protected PDF into your library on Android, OnlyScans asks for the password before it opens the file. PDF import is a Pro feature.
Pairing a password with App Lock (Pro) and the free Privacy screen setting keeps the unlocked copy in your library private as well. Our sister site has more on that in its private document scanner overview.
Frequently asked questions
Can a password-protected PDF be opened on any device?
Yes. Encrypted PDFs are part of the PDF standard, and mainstream readers on Android, iPhone, Windows and Mac prompt for the password and open the file. Very old or minimal viewers may not support AES, so if a recipient has trouble, ask them to try a current PDF reader.
Can I remove the password later?
Keep your unprotected original and export a new copy without a password. Removing a password from an encrypted file always requires knowing it.
Is AES-128 secure enough?
Yes, for this purpose. Nobody breaks AES-128 by attacking the encryption itself. The realistic risk is a weak password, which is why a long passphrase matters more than the key length.
Does a password stop the recipient from forwarding the document?
No. Anyone who knows the password can open the file and share its contents. Send sensitive files only to people you trust, and share only what they need.