Skip to content
breathier.
Log inShare a document

How to password-protect a document you share by link

PDF and Word passwords, link passcodes and account-based sharing compared, plus how to add expiry dates and choose and send a passcode safely.

By The Breathier team · Published · 10 min read

A brass padlock resting on a closed paper folder on a dark wooden desk, with a laptop softly blurred behind it.

There are three ways to password-protect a document you share: lock the file itself (a PDF or Word password), lock the link that opens it (a passcode), or share it only with named accounts. The right one depends on a single question: will the file leave your control? A password inside the file travels with every copy and can never be taken back; a passcode on a link stays on a server where you can expire it or switch it off. This guide explains how each works, how to set them up, when to add an expiry date, and how to choose and send a passcode using guidance from the UK's National Cyber Security Centre (NCSC) and the US National Institute of Standards and Technology (NIST).

Three kinds of protection, three different jobs

People say "password-protected" for quite different things. Here's how they compare.

Password on the file Passcode on the link Sharing with named accounts
Where the lock lives Inside the file On the server On the server, tied to an account
Can you revoke access after sending? No: every copy keeps its password Yes: expire or switch off the link Yes: remove the person
Limits on guessing None once someone has the file Set by the service The account's own sign-in
What the reader needs The password and a compatible app The link, the passcode and a browser An account, or a one-time code
Best for Files that must travel as attachments Readers outside your organisation Colleagues and regular collaborators

Option 1: put a password on the file itself

PDF passwords: open password and permissions password

The PDF format has two kinds of password. The open password (also called the user password) is needed to open the file at all. The permissions password (owner password) controls actions such as printing, copying text and adding comments.

On a Mac, Preview can add both:

  1. Open the PDF in Preview and choose File > Export. Give it a new name if you want to keep an unprotected original.
  2. Click Permissions, select Require Password To Open Document, and type the password twice.
  3. Untick any actions you want to restrict, and set an owner password.
  4. Click Apply, then Save.

Because both passwords are part of the PDF format itself, other PDF tools can set them too. Two technical points are worth knowing, both explained in the documentation of qpdf, a widely used open-source PDF tool:

  • Permissions are honour-system. Anyone who can open the file holds the decryption key, so restrictions on printing or copying are enforced only by software that chooses to respect them. A permissions password without an open password stops very little.
  • Use 256-bit AES. It is the only encryption method not deprecated in the PDF 2.0 standard. If your tool offers a choice, pick it.

Word passwords: Encrypt with Password

In Word for Windows, go to File > Info > Protect Document > Encrypt with Password, type the password, confirm it, and save the file. In Word for Mac, it's Review > Protect > Protect Document, where you can require a password to open the document, to modify it, or both.

Microsoft's warnings are worth reading before you start. Word can't recover a lost password for you, and Word for the web can't encrypt a document with a password. Microsoft's help page also says Word document passwords can be at most 15 characters, which leaves little room for the longer passwords recommended below.

The catch: the password travels with the file

A password inside a file is only as good as the last person who had both. Once you've emailed it, you can't change the password, set an expiry date or take it back. If the recipient forwards the file and the password together, the new reader is in exactly the same position as the old one.

There is also no limit on guessing. NIST's guidance points out that throttling, slowing down or locking out repeated wrong attempts, is the main defence against online attacks, while an attacker working offline isn't subject to any rate limiting. A protected file that has been copied is offline by definition: whoever has it can try passwords at their own pace. That's why a short file password is weaker than it looks.

File passwords still suit documents that must travel as attachments. Our guide to sending a link instead of an attachment covers when a link works better.

With a link passcode, the document stays on a server. The link opens a page that asks for the passcode, and only then shows the document. Because you control the server side, you keep control after you hit send:

  • You can close it. Expire the link or switch it off, and the passcode stops mattering.
  • Guessing can be limited. The service can lock the link after a few wrong tries. The NCSC prefers throttling to lockout, and where lockout is used, it recommends allowing between 5 and 10 attempts.
  • One document, many passcodes. Give each recipient their own link and passcode, so one leak doesn't force you to reset everyone.

Several services offer this. OneDrive lets you set a password on a link, but only for Microsoft 365 subscribers, and on folders only for "Anyone" links. Dropbox offers passwords on shared links on its Professional, Essentials, Standard, Advanced, Business, Business Plus and Enterprise plans (checked on 15 November 2026). Google Drive's sharing help describes no password option for links; it relies on named accounts instead, covered below.

Setting it up in Breathier

Breathier is a free tool for sharing documents by link and seeing who read them. Every link can have its own passcode:

  1. Sign in with your email or Google account and upload the document (PDF, Word, PowerPoint, Excel, CSV or pictures).
  2. Create a link and name it after the person who'll get it, such as "Acme Ventures". One document can have up to 50 links.
  3. Turn on the passcode and set one. Ten wrong tries lock the link for 15 minutes, in line with the NCSC's 5 to 10 attempts.
  4. Add an expiry date, and decide whether to allow downloads.
  5. Send the link, and send the passcode separately (see below).

Readers don't need an account. Links with a passcode also don't show the document's first page when pasted into WhatsApp, LinkedIn or Slack, so a preview doesn't give away what the passcode is protecting.

Mind the download button

A passcode protects the link, not the file. If downloads are allowed, the reader gets the original file, exactly as uploaded and with no passcode on it. For anything sensitive, turn downloads off: on Breathier this hides the download button and blocks printing from the viewer. It's a deterrent rather than copy protection, because anyone can take a screenshot. Dropbox says the same of its own setting: disabling downloads blocks them only through Dropbox, and people can still save the content in other ways.

Spreadsheets deserve extra care, because hidden sheets travel inside the file. Breathier doesn't show hidden sheets in its viewer, but a downloaded copy still contains them. Our guide to sharing a spreadsheet as view-only explains the trap.

Option 3: share only with named accounts

Instead of a shared secret, you can tie access to people's own sign-ins. In Google Drive, set General access to Restricted so only people you add can open the file, then add them by email. If your organisation allows it, Drive can also share with people who don't have a Google Account: they verify with a code emailed to them and can then work on the file for 7 days. OneDrive's Specific people links work in a similar way.

This is the strongest option for identity, because nobody has to pass a password around. The trade-off is friction: an investor, client or candidate may not want to sign in, verify an address or create an account just to read eight pages.

One point of comparison: if a Breathier link asks for an email, the reader types it, and it isn't verified. It tells you who someone says they are. Pair it with a passcode sent through a separate channel when identity matters.

Add an expiry date

An expiry date turns "I hope they've deleted it" into "it's closed". Most services offer one, with different rules:

  • Google Drive: available for work and school accounts, up to one year ahead, and only for the Viewer role on folders.
  • OneDrive: link expiry, like passwords, is for Microsoft 365 subscribers.
  • Dropbox: a link expires at 11:59 pm on the chosen day, in your time zone, on the same paid plans as passwords.
  • Breathier: each link has its own expiry date, and you can switch any link off at once; anyone reading is closed out within seconds.

Expiry has the same limit as everything else here: it can't reach copies that were already downloaded. For a fuller picture of what happens after someone opens your link, see our guide to seeing who opened a PDF.

How to choose a passcode

The good news is that modern guidance has dropped the gymnastics. Both NCSC and NIST put length ahead of complexity.

  • Use three random words. The NCSC recommends joining three random words, which gives a password that's hard to crack but easy to remember.
  • Avoid the obvious. Skip common passwords, significant dates, sports teams and family or pet names. The NCSC adds that swapping letters for numbers, such as o for 0, doesn't make a password much stronger, because criminals know the trick.
  • Make it long. NIST's current standard tells services to require at least 15 characters for a password used on its own, and at least 8 when it is one part of multi-factor sign-in.
  • Don't bother with symbols for their own sake. NIST says services shall not impose composition rules, such as mixtures of character types, and the NCSC doesn't recommend complexity requirements either.
  • Make it unique. A different passcode for each link means one leak stays one leak.
  • Let a password manager help. The NCSC suggests a password manager to create strong passwords and remember them for you.

How to send the passcode safely

The point of a passcode is that the link alone isn't enough. Send both in the same email and you've undone that. Microsoft's OneDrive help puts it simply: you need to give recipients the password separately.

  • Use a different channel. Email the link; send the passcode by text message, messaging app or phone call. Someone who gets into one channel then doesn't automatically get both.
  • Keep it out of subject lines and calendar invites, which tend to be seen by more people and kept for longer.
  • Share it with as few people as possible. When a password has to be shared, the NCSC advises keeping it within as small a circle of known, trusted people as you can. A link per recipient makes that easy.
  • Close up afterwards. When the deal is signed or the hire is made, switch the link off or let it expire.

FAQ

Is a password-protected PDF secure?

An open password with 256-bit AES encryption gives reasonable protection, provided the password is long and unique. But it can't be revoked, and anyone with a copy can keep guessing offline. A permissions password on its own is weak, because restrictions depend on software choosing to honour them.

Google's sharing help doesn't describe a password option for links. Instead, you restrict the file to people you add by email, and work or school accounts can add an expiry date. For a passcode on a link, you'd need a service that offers one, such as OneDrive with Microsoft 365, paid Dropbox plans or Breathier.

What's the difference between a password and a passcode?

In everyday use, little: both are secrets you type to get in. In this guide, a password locks the file itself, while a passcode locks the link that opens it. The difference is what happens later: a link passcode can be closed by expiry or a switch, a file password can't.

No. If both arrive together, anyone who gets that one email gets everything. Send the link by email and the passcode by text, messaging app or phone, as Microsoft's OneDrive help also advises.

What happens if someone types the wrong passcode?

That depends on the service. On Breathier, ten wrong tries lock the link for 15 minutes, which slows guessing to a crawl. The NCSC recommends allowing 5 to 10 attempts where lockout is used.

Yes, if the protection lives on the server. Switching off a Breathier link closes it at once, and anyone reading is closed out within seconds. It can't reach a copy they already downloaded, so turn downloads off for sensitive documents.

You'll find more practical guides in the resources hub.

Sources

Try it on your own document

Share one. See who reads it.

Share a document All guides
10 min readHow to see who opened your PDF and which pages they readWhat read receipts, tracking pixels, PDF scripts and tracked links can and can't tell you about who opened your PDF, and how to track it fairly.11 min readHow to share a pitch deck with investors and read the signalsPrepare a send-ahead deck, choose PDF or PowerPoint, give each investor their own link with sensible rules, read the numbers and time your follow-up.10 min readFree DocSend alternatives compared on price, tracking and limitsWhat DocSend costs, and how Papermark, Google Drive, Dropbox and Breathier compare for sharing documents by link and seeing who read them.