How to password-protect a PDF on Android

A password on a PDF is not a lock on a folder. It is a cryptographic operation on the file’s contents, and it happens at one specific moment. Get that moment wrong and the lock is decorative.

The practical question is not “does this app have a password box?” It is “where was the file while it was still readable?”

What are the two kinds of PDF password?

PDF has supported two passwords for decades, and conflating them is the most common mistake:

The user password — also called the open password. The reader will not display a page until it is entered. This is the one that protects content.
The owner password — also called the permissions password. It is supposed to stop printing, copying or editing while still letting the file open. Many readers ignore these flags entirely, and some tools remove them without asking.

If the document matters, set an open password. If you only want to stop casual editing, a permissions password is a speed bump, not a lock. Some tools let you set the two separately; ScanLocker sets both to the password you choose, so the open password is the one doing the work.

What does AES-256 actually protect?

It protects the bytes of the file, wherever they go. A correctly encrypted PDF is unreadable in a file manager, in cloud storage, on a USB stick, or in an email attachment. That is exactly the property you want when a document has to leave the phone.

It does not protect against:

A weak password. AES-256 is not the weak link; 1234 is. Someone holding the file can guess offline, at whatever rate their hardware allows.
A compromised device. If malware is reading the screen while the document is open, encryption at rest does not help.
A screenshot. An open document can be photographed.
The recipient. Once you share the password with someone, the file’s security is their behaviour, not yours.

That is not a reason to skip it. It is a reason to use a passphrase and a password manager, and to send the password through a different channel from the file.

Why does the order of operations matter?

On Android, “saved” is not one place. Files in shared storage — Documents, Downloads, a folder a file manager can browse — are readable by other apps that hold document or media access, and they are the files cloud backup services copy. Files in app-private storage are not.

So there are two pipelines, and only one of them is safe:

Encrypt after saving. The PDF is assembled as plaintext, written to a public folder, then encrypted, then the plaintext is deleted. There is a window — seconds or minutes — when a readable copy exists in a place another app can reach. Deletion is not a guarantee either.
Encrypt before saving. The PDF is assembled in memory, encrypted in memory, and only the encrypted bytes are written. There is no plaintext file at any point.

The second is the only one that makes the password meaningful for a document that was sensitive before you scanned it.

How does ScanLocker do it?

ScanLocker builds each page as an image, assembles the PDF in memory, applies AES-256 encryption with your password, and writes the encrypted bytes into its app-private vault. The plaintext PDF is never written to shared storage.

For a PDF that already exists, the app reads the bytes, sets the security on the document, saves it, and overwrites the original file — so the encrypted version replaces the readable one rather than sitting beside it.

The password itself is kept in Android’s Keystore-backed secure storage on the device, so the app can reopen the document without asking you every time. The PDF does not contain the password; that copy stays on the phone and does not travel with the file. If you move the PDF to another device, you need the password you chose.

Everything here is local and free. There is no Pro gate on password protection, no upload, and no account.

What should you check before you trust a password?

Four questions, in order:

Is the file encrypted, not just restricted? Open it in a different reader — a desktop PDF viewer, not the app that made it. If it opens without asking for anything, there is no open password.
When was it encrypted? If the app cannot tell you whether a plaintext copy was written first, assume one was.
Where is the file now? An app-private vault is safer at rest but harder to get out of; a public folder is easier to move but readable by more apps. Both are defensible if the file is encrypted.
Can you get back in? Store the password in a password manager before you close the document. There is no recovery path from the file.

A password is only as good as the moment it is applied. Encrypting a file that has already been sitting in Downloads for a week protects the future, not the week.

For where the encrypted file actually lives, see where scanned PDFs are stored on Android. If you are still choosing a scanner, the document scanner comparison covers which ones encrypt locally and which ones upload first.

Common questions

What is the difference between a PDF open password and a permissions password?

The open password — the user password — is required before the file will display. The permissions password, sometimes called the owner password, is meant to restrict printing, copying or editing. Many readers ignore the second one, so if the content is sensitive, set an open password rather than relying on restrictions.

Is AES-256 PDF encryption safe?

Yes, as a file format. AES-256 is the strongest option PDF supports, and a properly encrypted file is not readable without the password. The weak point is the password itself: a short or reused password can be guessed offline, and no amount of key length fixes that.

Can a password-protected PDF be recovered if I forget the password?

Not by the scanner app. If the file is encrypted and you no longer have the password, the bytes are not decryptable by the app that made them. Some apps keep the password in their own secure storage so they can reopen the document on that device, but that copy does not travel with the file.

Is PDF password protection free in ScanLocker?

Yes. Setting, changing and removing a password is not behind the Pro purchase, and it is not a rewarded-ad action. Scanning, saving and encryption are local, so the free tier can do all of it without a server or an account.

Should I encrypt a PDF before or after saving it?

Before it reaches shared storage. If the file is written to a public folder first and encrypted afterwards, there is a window when a plaintext copy exists where other apps and cloud backup can read or copy it. Encrypt in memory, then write the encrypted bytes.