>

Password-protect a PDF with qpdf

Encrypt a PDF with a user and owner password (AES-256) from the command line.

LinuxqpdfpasswordspdfencryptionMedium risk
Run qpdf --encrypt owner-pass user-pass 256 -- input.pdf output.pdf — user-pass is what readers must type to open it.

01Command

Command
$ qpdf --encrypt owner-pass user-pass 256 -- input.pdf output.pdf

02What it does

qpdf's --encrypt sets two passwords: the user password (needed to open the file) and the owner password (needed to change permissions). 256 selects AES-256, the strongest option. Extra flags between the key length and -- control restrictions: --modify=none blocks editing and --extract=n blocks copying text. To remove protection, qpdf --decrypt with the password writes a plain copy.

03Risk

RiskMedium risk
Requirementsqpdf installed. The encrypted PDF needs a PDF 1.7+ viewer for AES-256.
!Warning: If you forget both passwords the PDF is effectively unrecoverable — qpdf is not a password cracker. The -- separator is required before the input file. Recipients on very old readers may need the weaker 128-bit option instead of 256.

04Undo

Undo
$ qpdf --decrypt --password=user-pass output.pdf decrypted.pdf

05Sources

  • qpdf(1) - PDF transformation software
    Ubuntu Manpages · community · 2026-09-17
    Evidence: qpdf --encrypt user-password owner-password key-length [options] -- infile outfile adds encryption; --decrypt removes it with the correct password.
  • qpdf: Encryption — official documentation
    qpdf project · community · 2026-09-17
    Evidence: Documents user vs owner passwords, 256-bit AES encryption and restrictions such as --modify=none and --extract=n.

Last verified: 2026-09-18 · Category: Media