Files are processed in your browser, not uploaded. Privacy →
Deckle
Open a PDF
Skip to guide

Passwords

How to choose a strong password for a PDF

By DeckleUpdated

A strong PDF password is long, random and used only for that file: a passphrase of four to seven unrelated words, or at least 16 random characters from a password manager. Length matters more than symbols. Password protect PDF accepts anything of six characters or more and encrypts the file with AES-256, so the password is the only part an attacker can realistically guess. Make it the strong part.

Password protect PDF

Three different privacy tasks

Password

Controls access

Metadata

Document properties

Redaction

Selected page content

Choose the change; inspect the saved copy

Conceptual comparison · access, properties and content require separate checks. No single task certifies complete privacy.

How to set a strong password on a PDF

  1. Generate the password first. Use your password manager's generator, or pick four to seven unrelated words.
  2. Save it in your password manager, named after the document.
  3. Open Password protect PDF and choose your PDF, or drop it onto the page.
  4. Paste the password into Password and again into Confirm password.
  5. Choose Protect this PDF.
  6. Download the copy and open it with the saved password to make sure the stored version works.

Pasting from the manager into both fields means the password you saved is exactly the one on the file.

What makes a PDF password strong

Encrypted PDFs can be copied and attacked offline, with software trying guess after guess. There is no lockout after a wrong attempt, so the password has to hold out on its own. CISA's advice is that a strong password is long, random and unique:

  • Long. Each extra character multiplies the number of guesses needed. CISA recommends at least 16 characters.
  • Unpredictable. Words from the document, names, dates, postcodes and keyboard patterns such as qwerty are tried first.
  • Unique. A password reused from an email account or another file is already in someone's list if that account was ever breached.

The six-character minimum in Deckle is the shortest password the form accepts, not a recommendation.

Examples

Password Why
Smith2026 Weak. A surname and a year are among the first guesses
copper tulip ferry Too short. Three common words, 18 characters, but fewer than four words
P@ssw0rd! Weak. Symbol swaps for common words are in every guessing list
invoice-0423 Weak. Built from the document's own details
copper tulip ferry lantern Strong. Four random words, 26 characters, easy to read out
x7Rq-mW2k-9fLp-Tz4v Strong. Random, 19 characters, best stored in a manager

A passphrase works well when you must tell someone the password by phone. A random string is better when both of you use a password manager.

Passwords for documents you send

When the password goes to someone else, it also has to be easy to pass on without mistakes.

  • Avoid look-alike characters. 0 and O, 1, l and I cause most "wrong password" calls. See why a PDF password is not working.
  • Avoid trailing spaces and accented letters. They are invisible or typed differently on other keyboards.
  • Use a new password for each recipient or batch. If one is shared further, the other documents stay closed.
  • Send it by a different channel from the file. A phone call, a text message or a separate messaging app. How to share a password-protected PDF covers the options.

Passwords to avoid entirely

Some organisations protect PDFs with the recipient's date of birth or the last digits of an account number. That is convenient but guessable by anyone who knows the person. For documents you control, do not copy that pattern. A random passphrase sent separately is safer and no harder to use.

Tips

  • Generate, do not invent. People choose predictable passwords even when trying not to. A generator does not.
  • Store before you send. Deckle does not keep the password, and a forgotten one cannot be recovered.
  • Change a password that was exposed. If it went to the wrong person, follow how to change the password on a PDF and resend.
  • Do not put the password in the file name or email subject. It defeats the protection the moment the message is seen.

Frequently asked questions

How long should a PDF password be?

At least 16 characters, as CISA recommends, or a passphrase of four to seven random words. Six characters is only the minimum Deckle accepts.

Are symbols and numbers necessary?

Not if the password is long and random. A long passphrase of plain words is stronger than a short password with symbols.

Is the password I type sent to Deckle?

No. It is used in your browser to encrypt the file and is not stored, sent or written into the result record. Undo keeps only one step, so the form does not hold a long history of what you typed.

Can I use the same password for all my PDFs?

You can, but one leak then opens every file. Use a different password for each document or each recipient.

Related tools

Sources