Password-protect a PDF
Some documents should not open for anyone who happens to get a copy of the file. This password protect PDF API encrypts a document with a password you choose, so opening it at all — not just editing it — requires knowing that password, and it does this without asking you to touch a desktop tool or manage encryption keys yourself.
Run it online
Run this on our servers with your account. Free tools run in your browser; this one bills your KIT balance per the price above.
Why a password beats hoping the link stays private
A file sitting in a shared drive, forwarded email thread, or misconfigured storage bucket is only as private as everyone who has ever touched it. Payroll summaries, medical records, signed contracts, and financial statements routinely leak this way — not through a breach, but through a copy that ended up somewhere it should not have. Encrypting the PDF itself changes the failure mode: even if the file reaches the wrong hands, it stays unreadable without the password, which is a meaningfully stronger guarantee than access control on a folder.
What happens when you call it
You call POST /pdf/protect with your document and the password to apply, and you get a task_id back immediately while the encryption runs asynchronously. The result is a PDF encrypted with a standard, widely supported user password: any PDF viewer will prompt for that password before rendering a single page, and without it, the content is not just hidden behind a permission flag but genuinely encrypted at the file level.
How PDF encryption actually works
PDF has supported password-based encryption since the format's early revisions, using symmetric algorithms that scramble the document's content streams so a viewer cannot render them without deriving the correct decryption key from the password. It is worth being precise about what this protects: it guards the file at rest and in transit, but it is only as strong as the password chosen, and a weak, guessable password undermines even solid encryption. This endpoint applies the encryption correctly; choosing a strong password is still on you.
Where it belongs in a pipeline
Add this step right before a sensitive document leaves your system — after a report is generated, after a contract is finalized, or after a statement is compiled for a client. It fits naturally alongside a flatten step, since a document is often finalized and locked down in the same pass before delivery, and it belongs anywhere personally identifiable or financial data is being emailed or handed off outside a controlled system.
Delivery, pricing, and current status
Results arrive by signed webhook or a signed link valid for 24 hours, and the source document, the password, and the encrypted output are all deleted after the retention window — none of it is ever used to train a model. Pricing is $0.042 per request plus $0.0025 per document. This endpoint is currently in deployment and not yet accepting live jobs; it will go live shortly, so check current status before building it into a production pipeline.
What you can do with it
Lock a payroll or HR document before emailing it
Encrypt a compensation letter or a payroll summary with a password before it goes out by email, so a misdirected message or a forwarded copy does not expose the contents.
Protect client financial statements at delivery
Password-protect a generated invoice or statement before it lands in a client's inbox, using a password scheme like a known reference number so only the intended recipient can open it.
Secure legal documents shared with external counsel
Encrypt contracts or filings before they leave your system for outside counsel or a regulator, ensuring the file itself carries protection independent of how it is transmitted.
Add a protection step to an automated report pipeline
After a nightly job compiles a confidential report, encrypt it automatically before it is uploaded to a shared drive, so the file is never briefly exposed unprotected.
FAQ
How do I password protect a PDF with an API?
Call POST /pdf/protect with your document and the password to apply; you receive a task_id right away, and the encrypted file is delivered to your signed webhook or a signed link once ready.
Is the password protect PDF API free?
There's no free tier — free tiers get abused and slow everyone down. Access runs on a prepaid ForHosting KIT balance: top up from $10.00 (it never expires) and each request is charged at its published price, so a call with no balance returns HTTP 402. No subscription, no tokens, no invented credits, and a failed task is never charged.
Does the password stop editing, opening, or both?
This applies a user password, which controls opening the document itself: without it, a PDF viewer cannot render the content at all, which is a stronger restriction than just blocking edits or printing.
How strong is the encryption?
It uses PDF's standard, widely supported encryption, which is strong at the algorithm level; the real-world strength of your protection still depends on choosing a password that is not easily guessed.
Can I protect many documents at once with different passwords?
Yes. Each request is an independent asynchronous task, so you can submit a batch with a distinct password per document and collect each encrypted file by webhook as it completes.
Is the password stored anywhere after processing?
No. The password, source document, and encrypted output are all deleted after the retention window; nothing is retained beyond what is needed to deliver your result.
Is this endpoint available right now?
It is in deployment and not yet accepting live jobs, with availability expected shortly. Check current endpoint status before integrating it into production.
What if I forget the password after encrypting a document?
There is no way to recover an encrypted document without its password, since the encryption is genuine; keep a secure record of any password you apply, or generate it from something you can reliably reproduce.
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/pdf/protect \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"pdf":"https://ejemplo.com/documento.pdf"}'const res = await fetch("https://api.kit.forhosting.com/pdf/protect", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"pdf": "https://ejemplo.com/documento.pdf"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/pdf/protect",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"pdf": "https://ejemplo.com/documento.pdf"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/pdf/protect", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"pdf":"https://ejemplo.com/documento.pdf"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"pdf":"https://ejemplo.com/documento.pdf"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/pdf/protect", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"pdf": "https://ejemplo.com/documento.pdf"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "pdf.protect",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
max_mb | 25 |
max_pages | 200 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
413 | input_too_large | The file exceeds the size limit. |