How strong is the encryption?

It is AES-128, written as a version 4 standard security handler with the AESV2 crypt filter. That is real encryption rather than the 40-bit RC4 that some older tools still emit, and it is understood by every mainstream PDF reader. A document is only ever as strong as its password, though — a short one can be guessed regardless of the cipher behind it.

Can you recover my password if I forget it?

No, and nobody else can either. The encryption happens on your device and nothing — not the file, not the password, not a hint — is stored anywhere. A forgotten password means a document that cannot be opened, so keep a copy of the original somewhere safe.

Do the permission switches really stop people printing or copying?

Not by force. Those flags are recorded in the document and mainstream readers honour them, which is genuinely useful for ordinary handling. But once the password is accepted the content is decrypted, so software that chooses to ignore the flags can print or copy anyway. The password is the part that actually protects the file; the permissions are a request.

Is my file or my password uploaded anywhere?

No. Both stay in your browser. The page ships a Content Security Policy that blocks connections to any other origin, so there is no request that could carry them even in principle. You can turn off your network connection and the tool still works.

Protect a PDF with a password

Lock a document so it asks for a password. Your file never leaves this device.

Nothing is uploaded
Works offline

Drop your PDF here

Add a password that has to be typed before the document will open. It is encrypted on this device and never uploaded.

Encrypted here, not on a server

Password-protecting a document on most sites means uploading the very file you are trying to keep private, and handing over the password with it. Docqify encrypts it in your browser instead, using AES-128 — the standard security handler that Acrobat and every mainstream reader understand. The password is used to derive the key and then forgotten when the tab closes. It is never sent anywhere, because the page is not permitted to send anything anywhere.

The encryption is AES-128, written as a standard PDF security handler, so the file opens in any normal reader once the password is given.
The permission switches are recorded in the document and respected by mainstream readers, but nothing enforces them. Once the password is accepted the content is readable, and software that ignores those flags can do as it likes.
There is no way to recover a forgotten password — not by us, not by anyone. Nothing is stored, so keep the original.
Everything runs on your device. The page ships a Content Security Policy that blocks connections to any other origin, so neither the document nor the password can be sent anywhere.

Questions

Protect a PDF — the details

PDF tools

Already have a PDF?

The same guarantee applies to every one of these: the file is opened by your browser, worked on there, and never sent anywhere.