Uploading a file to protect it is the wrong way round
Think about what the usual free tool asks you to do. You have a document sensitive enough to be worth a password, and the first step is to send it, unprotected, to a server you know nothing about, along with the password you are about to protect it with.
The file is then encrypted on that machine and sent back. For the time it sits there it is readable, and so is the password. Most of those services keep files for a few hours.
Here the encryption runs on this page, on your machine. Neither the document nor the password goes anywhere, which you can check in your browser network tab while you use it.
How this tool works
The engine is qpdf, the reference tool for PDF encryption, compiled to run in the browser. It downloads once when you use the tool, from this site rather than anybody else's.
Your document is encrypted in the page and handed straight back as a download. The password is used where you typed it and is never sent anywhere, stored or written down, which you can confirm in your browser network tab while you use it.
The pages themselves are untouched: the document is encrypted rather than rebuilt, so text stays selectable, drawings stay sharp and the file stays roughly the size it was.
AES-256, and why the other options are missing
A PDF can be encrypted four ways and three of them should not be used. 40-bit RC4 is broken outright and is cracked in seconds by tools anyone can download. 128-bit RC4 is broken too. 128-bit AES is respectable but superseded.
This does AES-256 and offers nothing else, because a choice between one good option and three bad ones is not a feature. Every reader made in the last decade opens it.
Nobody can recover this for you, and that is the point
Said plainly because it is not a figure of speech. There is no copy of your file and no copy of your password anywhere: not on a server, not in this page after you close it. Forget the password and the document is unreadable permanently.
Anything advertising itself as being able to recover a forgotten PDF password is either guessing at it, which only works on a weak one, or exploiting the broken 40-bit mode. Neither touches a decent password on AES-256.
So make it a long one and write it down somewhere real. Length does far more work than punctuation: four unrelated words beat eight characters of symbols, and you can remember them.
Restrictions are a request, not a lock
The settings for printing, copying and editing are permission flags stored in the document. A reader is expected to honour them and most of the well-known ones do.
But anybody who can open the document can ignore them, and plenty of software does. So they are worth setting as a signal of what you intend, and they are not worth relying on. The password is what actually stops somebody.
Screen readers are always permitted here whatever else is switched off. Blocking them is something other tools let you do and it should not be a thing.
Test it before you send it
Open the saved file and check the password works. This applies to any tool, not just this one: the moment you rely on a protected file you have not opened is the moment it turns out to be the wrong one.
The pages themselves are untouched. The document is encrypted rather than rebuilt, so text stays selectable, drawings stay sharp and the file stays roughly the size it was.
Common questions
How do I password protect a PDF for free?
Drop the PDF in, type a password twice, and press the button. You get a file encrypted with AES-256 that will not open anywhere without it. No account, and neither the document nor the password is uploaded.
Is the password sent anywhere?
No. The encryption happens on this page using your own machine, so the password never leaves the browser and is not stored. You can confirm it in your browser network tab, which is the whole advantage over a site that asks you to upload the document you are trying to protect.
What happens if I forget the password?
The document is gone. Nobody can recover it, including us, because there is nothing to recover from: no copy of the file and no copy of the password exists anywhere. That is what makes the protection real rather than decorative.
How strong is the encryption?
AES-256, which is the current standard and what any modern reader expects. The 40-bit and 128-bit modes that most tools still offer are both broken and are not offered here.
Can I stop people printing or copying?
You can ask. Those settings are permission flags a reader is expected to honour, and most do, but anybody who can open the document can ignore them. The password is the protection; the restrictions are a request.