Yes — and Mac users have an advantage here because the operating system includes a built-in way to do it without any additional software. You don't need Adobe Acrobat or any paid app. There are two free methods: one built directly into macOS, and browser-based tools for when you need more control over the settings.
Method 1: Using Preview (Built Into macOS)
Preview is Apple's built-in PDF viewer and it can password-protect PDFs directly. Open your PDF in Preview, then go to File → Export as PDF. In the export dialog, click the "Show Details" button (or the permissions dropdown depending on your macOS version), and you'll see options to set an owner password and a user password.
The user password is required to open the document. The owner password controls permissions — whether the recipient can print, copy text, or make changes. You can set one or both depending on what you need. After entering the passwords, click Save and Preview creates a new password-protected version of the PDF.
One important note: Preview uses 128-bit RC4 encryption by default, which is older and considered less secure than the AES-256 encryption used by more recent tools. For most everyday purposes — protecting a document from casual access — it's fine. For sensitive financial or legal documents where strong encryption matters, use a tool that specifies AES-256.
Method 2: Browser-Based PDF Protection
For stronger encryption or more control over permissions, a browser-based PDF Security tool is the better option and still free. WukongPDF's protect tool runs entirely in Safari or Chrome — upload the PDF, set a password, choose permission settings, and download the protected file. The encryption used is AES-256, which is the current standard for secure document protection.
The browser approach also works well when you're processing multiple documents, since you're not navigating through system dialogs for each one. Upload, set password, download, repeat.
Open Password vs. Permissions Password
PDF password protection has two distinct layers that many people don't realize are separate. An open password (also called a user password) prevents anyone from opening the file without entering the correct password. A permissions password (also called an owner password) allows the file to be opened by anyone but restricts specific actions — printing, copying text, editing, or adding annotations.
You can set both, either, or neither. A common use case for permissions-only protection: send a contract that anyone can open and read, but restrict editing and copying to prevent tampering. A common use case for open password protection: sensitive financial statements that should only be accessible to specific recipients who know the password.
Sharing a Password-Protected PDF
Never send the password in the same email as the protected PDF — that defeats the purpose. Send the PDF first, then share the password through a different channel: a text message, a phone call, a separate email, or a secure messaging app. This way, intercepting the email doesn't give access to the document.
Also tell the recipient that the PDF is password-protected before they try to open it. Unexpectedly hitting a password prompt on a document you were just emailed can look like malware or a phishing attempt, and some recipients will delete the file rather than ask for the password.
What Password Protection Does and Doesn't Do
Password protection controls access and permissions on the file itself. It doesn't control what happens after someone opens it. A recipient who knows the password can open the PDF, take a screenshot of the contents, photograph the screen, or transcribe what they see. PDF password protection isn't a digital rights management system — it's an access control. Don't rely on it to prevent a determined recipient from sharing the content.
For everyday business purposes — protecting client documents, securing personal financial files, adding a layer of protection to confidential correspondence — password protection does exactly what most people need it to do. It keeps the document out of the hands of anyone who doesn't have the password, and that's usually sufficient.