Why the Protect PDF button won't accept your password

You typed Bill@1234. Nine characters. A capital, lowercase letters, a symbol, four digits. The meter says Weak and the Protect PDF button sits there greyed out, refusing to do anything.

It looks like a bug. It is not. There is one specific rule in that password check that Bill@1234 trips, and once you know which one, the fix is a single keystroke.

The rule is not "tick all five boxes"

PDF Password Protect shows five checks under the field:

• At least 8 characters
• Upper and lower case
• A number
• A symbol (!@#$…)
• Not a common or repeated password

Reading that list, most people assume all five have to go green. They do not. The gate that actually controls the button is:

1. At least 8 characters. No exceptions.
2. At least three of the four character classes — lowercase, uppercase, digit, symbol. You are allowed to skip one.
3. Not a common or repeated password. No exceptions.

That second point is why Ramesh2024 passes with no symbol at all. Uppercase, lowercase and digits are three classes, and ten characters clears the length bar. The symbol row stays grey and the button still lights up.

What actually blocked Bill@1234

Rule three has two halves. One is a list of known-bad passwords. The other catches lazy patterns, and it is the one that surprises people:

Four or more characters in a straight run — ascending or descending — fail, and so does any character repeated four times in a row.

1234 is a four-step ascending run. So is 4321 descending, wxyz, and 5678. 1111 and aaaa are four-in-a-row. Any of these anywhere in the password knocks the score straight down to Weak regardless of everything else in it.

So:

• Bill@1234 → blocked. The 1234.
• Bill@123 → accepted. Three digits is only a three-step run, which is under the threshold. Eight characters, four classes, done.

One character shorter and it passes. That is genuinely the whole difference.

The common-password list, and why capitals do not save you

The password is lowercased before it is compared against the known-bad list. Password123, PASSWORD123 and password123 are identical as far as the check is concerned, and all three are on it.

The list is short and deliberately high-signal — password, qwerty, admin123, letmein, welcome, abc123, iloveyou, secret, changeme, test123 and their close relatives. It is not trying to be a breach corpus. It is trying to catch the twenty passwords everybody reaches for first.

Worked examples

Good is the pass mark, not Strong

The four labels map to specific things:

• Weak — fails the common-or-run check, or is under 8 characters.
• Fair — long enough, but only two character classes.
• Good — 8 or more characters with three or four classes. This is where the button becomes clickable.
• Strong — 12 or more characters with three or four classes.

You do not need Strong. Chasing it is how people end up with a password they cannot read out over the phone.

Read the hint line, then read it again

Under the button, when the password is not yet acceptable, there is a line naming what is still missing:

To protect this PDF the password still needs: at least 8 characters.

It names the first unmet requirement, not all of them. Fix that one and a different one may appear. That is not the tool moving the goalposts; it is working through the list in order.

Two more small things about that field. Pressing Enter runs the same check, so you cannot get past the disabled button with the keyboard. And leading or trailing spaces are stripped before the password is applied — if you paste something out of a chat message with a space on the end, the space is not part of your password, which matters a great deal when you are telling the recipient what to type.

Use the eye icon to reveal what you typed before you commit. There is no recovery afterwards, and a typo you cannot see is a locked document you cannot open.

The 25 MB ceiling and what to do about it

This tool is one of the few that is not purely browser-side. Standard PDF encryption is applied on the server, so the file has to go up — it is sent in 3 MB pieces to stay under the platform's request size limit, held in memory just long enough to encrypt, and discarded. Nothing is written to disk and nothing is kept. The dropzone caps the input at 25 MB.

If your file is over that:

• Shrink it. A scanned 60 MB document is almost always image data at a resolution nobody needs. Compress PDF will usually bring a file like that well under the limit without doing visible damage to the text.
• Or split it. Split PDF breaks a large document into parts you can protect individually. Slightly more awkward to send, but it works, and sometimes the recipient only needed section three anyway.

Whatever goes in comes back named yourfile_protected.pdf, so the original and the locked copy never get confused in your downloads folder.

Pick a password the other person can actually type

The last practical thing, and the one nobody thinks about until the phone call.

The person receiving this file has to enter the password. Possibly on a phone keyboard. Possibly after you have read it out over a bad line. Kirana#Store26 survives that. x7$Kq!2vLp#9 does not — it gets misheard, mistyped, and you end up sending the file again unprotected, which defeats the entire exercise.

Length beats exotic characters anyway. Two ordinary words, a number that means something to both of you, and one symbol will clear the Good threshold and stay speakable.

And keep the unprotected original. The password is never stored anywhere, so nothing can recover it for you. The only way back into a locked file is PDF Unlock — which needs the password you have lost. Everything else in this area, including the tools for restricting and marking up documents, is on the PDF tools page.