How to Password-Protect a Shared PDF Link (2026)

Put a password on your next shared link: create a free tracked link — password, expiry and download-off are all on the free plan, no card — or open the live demo first. The rest of this page is the comparison.

The 6 methods compared

Six mechanisms answer this question and they protect genuinely different things. Read the third column before the second: the useful question is not “is there a password” but “what is still true after the reader has the file.” Four of the six stop being enforceable at exactly that point, and knowing which four is the whole decision.

Two rows in that table survive a download and four do not, and that split is the honest shape of this whole topic. If your requirement is genuinely “this document must stay unreadable even after somebody saves it,” only file encryption and DRM answer it, and both cost you something real — encryption costs revocability and any record of who opened the document, DRM costs your reader a software install. If your requirement is the far more common “only the person I sent this to should be able to open it, and I want to be able to shut it off,” the link password is the one that fits, and it leaves you a reading record while it does so.

Method 1 — put the password on the link

You upload the PDF to a tool that hosts it and serves its own viewer, create a share link, and switch a password on for that link. The reader gets a URL, opens it, is asked for the password, and the document renders in the browser once it matches. Nothing is installed and nothing is emailed as an attachment.

What makes this the default answer for client and prospect work is not the password itself — it is everything the password comes with. Because the gate lives on the server, you can change the password after sending, remove it, expire the link on a date, or revoke it outright the day a deal dies. Because the document renders in a viewer you control, the same link records which pages were reached and for how long, so the access decision and the reading record are the same object rather than two systems that never meet. On PDFTrackr the password, the expiry date, the email gate and the download switch are all on the free plan, on up to 50 active share links across 50 files, with 12 months of history and no card.

Two practical notes that decide whether this method works in practice. First, create one link per recipient rather than one link for everyone: a shared password sent to nine people is a shared secret nine people can forward, and a link per person means revoking one person's access does not disturb the other eight. Second, send the password through a different channel from the link. A single email carrying both halves protects against nothing except a mistyped address, which is a real risk but a much smaller one than the message being forwarded.

The limit, stated plainly: a link password controls the door, not the room. The reader you let in can screenshot the screen, photograph it, or read it aloud to somebody else, and if you leave downloading on they can save the file and the password stops mattering to that copy entirely. Switching downloading off narrows that — it removes the button, not the bytes, since a browser has to receive a document in order to draw it. That is covered in detail in how to disable download on a shared PDF link.

Method 2 — encrypt the PDF file itself

The PDF format has its own password mechanism built into the specification: a document can carry an encrypted body that a reader application will not display until the right password is supplied. Desktop PDF editors and a large number of web tools expose it. Set it, save the file, and every copy of that file — attached, forwarded, downloaded, copied to a USB stick — keeps asking.

That durability is the whole point and it is also the whole cost. The password is written into the bytes, so it cannot be changed on copies that have already gone out. If you send the encrypted file to a client on Monday and the relationship ends on Friday, there is no revocation step; the only remedy is that the recipient chooses not to open it again. Nothing reports back either — an encrypted PDF sitting in someone's inbox is exactly as silent as an unencrypted one, so “did they open it” has no answer at all. And the recipient still needs the password by some channel, which is the same problem as method 1 with none of the flexibility.

Two smaller traps worth knowing. The format distinguishes an open password from a permissions password — the second restricts printing or copying while still letting anyone open the document, and it is enforced by the reader application rather than by cryptography, so a reader that chooses to ignore it can. And an encrypted PDF is a notably poor experience on a phone, where the reader may not be the app you expect. If you are sending to a client who will read it on a train, the link method is kinder.

Method 3 — password a cloud storage link

Several consumer and business storage products let you put a password on a public share link, which is mechanically the same idea as method 1: the gate is on the provider's server, you can change or remove it, and it stops at the download. If your document already lives in a shared folder your recipient uses, this is the least disruptive option on the page — nobody has to learn a new tool.

Two things to check before relying on it, and we deliberately name no specific product here: whether the setting is on the free tier or a paid one, and what the provider reports back to you afterwards. Storage products are built to store, and their reporting usually stops at an arrival — a view count, a last-activity timestamp — rather than telling you which pages held the reader. That is not a defect; it is a different job. This article holds dated reads of a small number of vendors' own pages and none of them covers a storage provider's link-password setting, so nothing here asserts which storage products have it or on which tier. Check your own provider's current pricing page rather than trusting a roundup, this one included — the setting moves between tiers more often than the feature itself changes.

Method 4 — put the PDF in a password-protected archive

Compressing the document into an encrypted zip and sending that is the oldest answer here and the one most often suggested by an IT policy. It works, in the narrow sense that the recipient cannot read the PDF without the archive password. It is also the weakest option on this page for a document you actually want read.

The protection expires at first use. The moment the recipient unzips the archive, there is a plain, unprotected PDF on their disk and the password is decoration. Many corporate mail gateways refuse encrypted archives outright, precisely because they cannot scan inside them, so the send may simply fail. Some archive formats encrypt file contents but leave the file names visible, which can be its own disclosure when a name reads like “acquisition-terms-final.pdf.” And you learn nothing: an archive that was never opened looks identical to one that was read twice. Use this when a policy requires it, not when you have a choice.

Method 5 — an email gate or a one-time code instead of a password

A password is a shared secret, and shared secrets get forwarded. The alternative is to gate on identity rather than on a string: the reader enters their email address before the document renders, or receives a one-time code at that address and enters it. Nothing has to be agreed in advance and nothing has to be sent through a second channel, which removes the most common failure of methods 1 through 4 — the password arriving in the same email as the link, or never arriving at all.

The trade is honesty about what the gate proves. A plain email gate asks for an address and takes the answer on trust; anyone can type anything. A one-time code is stronger, because the reader has to be able to receive mail at the address they claimed, and that turns a claimed identity into a verified one. PDFTrackr ships both — the email gate on the free plan, and verified viewer emails by one-time code, with allow and block lists, on Pro. The gate also changes what your reading record means: an anonymous session becomes a named one, so “somebody read eleven pages” becomes “this person read eleven pages.” For a document going to a named client rather than a public audience, that is usually worth more than the password.

A gate and a password are not alternatives in the exclusive sense — most tools that offer both let you turn on both, and for a genuinely sensitive document sent to one known person that combination is the strongest thing on this page that does not require the reader to install anything.

Method 6 — a DRM viewer with a licence check

Document-rights products take the opposite approach: the file is encrypted and can only be opened by a licensed reader application, which checks a licence with a server before it displays anything. Because the enforcement lives in the reader rather than in a gate you passed once, it keeps working after the file has been copied, and the licence can be revoked afterwards. This is the only route on this page that both survives a download and stays revocable.

The cost is borne by your reader, and it is not small: they must install and register a specific application to open your document, which for a prospect who has not yet decided to work with you is often where the engagement quietly ends. The reporting is also shaped by what a licensed reader can observe rather than by page-level reading. Locklizard, a long-standing product in this category, advertises print logging — Print logging: how often a document was printed, when and where, and Print logs identify the licensed user who printed, not only the count/time/place — while No per-page reading data appeared in any Locklizard material we have read. That is a genuine capability nothing else on this page has, and it is the right tool when the document is a licensed manual or a standard that must not circulate. It is the wrong tool for a proposal.

What a password actually stops — and what it does not

It is worth being blunt about the ceiling, because most writing on this subject is not. None of these six methods stops a reader who is allowed to see the document from remembering it, retyping it, photographing the screen or describing it to somebody else. What a password buys is control over the first step: who gets to look, and — for the three server-side methods — the ability to change your mind afterwards. That is a real and useful thing, and it is a smaller thing than “the document is secure.”

Two secondary questions come up constantly and both have short answers. Can somebody guess the password? On a link gate that depends on the tool: a server-side gate can rate-limit attempts, an encrypted file cannot, because the attacker has the file and can try offline at whatever speed their hardware allows. Choose a longer password for method 2 than for method 1 for exactly that reason. And does a password stop the document being forwarded? Not by itself — the link and the password can both be forwarded in one message. A link per recipient, plus a verified email gate, is what makes forwarding visible, because a second reader arrives as a second identity rather than as more traffic on the same link.

The last thing a password does not do is tell you whether the document worked. Access control and reading data are usually sold as separate categories and they answer adjacent halves of one question: the password decides who got in, and the reading record tells you whether getting in led anywhere. Our own corpus is a reminder of how large that second half is. Across 3,496 recorded sessions on multi-page documents, 45.2% never got past the first page — so for roughly half of all arrivals, the interesting event after the gate was that nothing happened. The distinction between an open, a click and a read is unpacked in the difference between an open, a click and a read.

Which tools do this on a free plan

A link password is common enough that the interesting question is not who has one but whether it is free, and what else the free plan gives you alongside it. Only two tools get a row below, and the reason is stated rather than implied: this article renders competitor facts from a stored, dated read of that vendor's own page, and up to 50 documents, page-by-page analytics, unlimited visitors is the one competitor statement on file that names password protection as a free-plan feature. The tools that rank alongside us for this search are named further down, without a row, because we hold no such read for them.

Read that table as two findings rather than one. Peony wins the timing row outright: included on every tier, Free first, so a Peony sender on the free plan knows the instant a reader passes the password gate, while ours reports it in the next morning's digest. PDFTrackr wins the control rows — the link expiry and the download switch are on our free plan, and Peony's published route to download prevention is the Business tier at $30/admin/month billed annually. Which of those matters more is a question about your own workflow, not a verdict either of us gets to write for you.

When Pro becomes the right choice

Free is the product here rather than a trial of it. The password, the expiry date, the email gate, the download switch, page-by-page reading and 12 months of history are all on the free plan and none of them expires or degrades. Pro is worth it once one of three things starts happening. The first is volume: one link per recipient means the 50-link ceiling arrives faster than the 50-file one, and Pro removes it and adds bulk personalised link creation, which is the difference between setting nine passwords by hand and generating nine links in a pass. The second is verification — when knowing that the person who opened it really controls that email address matters, one-time-code verification and allow and block lists are the Pro features that answer it. The third is timing: if learning within the hour rather than the next morning changes what you do next, that is the trigger. Full limits are on the pricing page.

How we evaluated this — and who is missing

The six methods above are described from how each mechanism works, not from any one vendor's marketing, which is why four of the six name no product at all. Where a product is named, the claim renders from a stored vendor fact read on that vendor's own page on 12–17 Aug 2026, in a browser or from raw HTML rather than a summarised fetch — with one disclosed exception: locklizard.com refuses connections from this network, so the two Locklizard claims above about who a print log names, and about the absence of per-page reading, were read by search retrieval of the vendor's own pages rather than by opening the URL. Where we hold no such read, this article says so instead of inferring the answer from a competitor's blog post or from what a tool “probably” does.

What is missing, and why. The live results for this search include Proton's blog, CapLinked, Papermark's blog, Wondershare, a DocSend blog post, FileXhost, SharePDF and an Adobe online tool. None of them has a row in the table above, and the reason is the same for all of them: we hold no dated read of that vendor's own page establishing whether a link password exists and which tier it sits on, and a feature cell decided from a search snippet is exactly the kind of cell this project has shipped wrong before. A two-row table we can stand behind beats an eight-row table we cannot. For a wider ranking of the tools in this category, see the free PDF tracking tools we compared.

What is out of scope, on purpose. Full-disk and mailbox encryption, secure file-transfer appliances and enterprise rights-management suites are all real answers to adjacent questions and none of them is the question here, which is what a single sender does with one document and one recipient this afternoon.

Keep reading: how to disable download on a shared PDF link, the difference between an open, a click and a read, and PDFTrackr's free tracking plan. Or start on the free plan and set a password on your first link today.