How to password protect a Google Doc

Why Google Docs password protection is useless & secure alternatives

This blog covers the various methods to password protect a Google Doc, why they are useless, and what you should be using to securely protect documents.

Live document collaboration has marked one of the biggest changes to employees’ day-to-day workflow since the shift to cloud computing.  Services like Google Docs allow for rapid iterations that many businesses now consider essential.  It’s important, however, to understand that housing sensitive documents on somebody else’s server, where they are constantly accessible and shareable, is not exactly good security practice.

Indeed, if you work with sensitive documents in this way, you run the risk that they will leak, either intentionally or through incompetence.  Due to Google Docs’ ineffective security controls, a hacker only needs to access the account of one person with viewing permissions for everything to fall apart.  The same can be said for intentional leaks, as an authorized viewer can easily share their Google account details with somebody.

   Is password protection the solution?

More needs to be done to protect sensitive data in Google Docs.  For many, adding an additional password may seem like the ideal solution.  This way, if a hacker happens to compromise a user’s Google account, they won’t be able to access documents without providing an additional password.  However, as you may have gathered from the title of this blog, it’s still far from an ideal solution.  Before we get into why, it’s useful to have an understanding of how to password-protect a Google Doc in the first place.

  How to password protect Google Docs

1. Download your Google documents or Google Sheet by pressing “File > Download > Microsoft Word/Excel”.
   
2. With the document open in Word/Excel, press “File” in your ribbon, then “Info”.
   
3. Click on the “Protect Document” button and choose “Encrypt with Password” from the list.
   
4. Enter a strong, unique password and press “OK”.
   
5. Enter the password a second time to confirm it. Press “OK”.
   
6. Save the document and re-upload it to Google Docs

   How secure is a Google Docs password?

Several issues make protecting documents with a password in Google Docs unworkable for most businesses.  The first is the process itself.  Downloading and re-uploading every file is time-consuming already, but if you don’t want a single point of failure, you’ll also have to protect each doc with an unique password.  You’ll need to find a way to distribute those passwords securely to the recipients, and have a process or support team in place in case they lose it.  Finally, you must somehow ensure that all of the users you send the password to will store it securely, rather than in a plaintext notepad file or a sticky note on their monitor.

Finally, but most importantly, passwords can be shared.  In instances where an insider is intentionally leaking a document, they can simply share the document password along with their account’s.  Alternatively, because Google Docs’ anti-copying controls are useless, they could just copy and paste the text to somebody or print the document (physically or to a file driver).

In the case of a user being hacked, passwords provide some protection, but can still be guessed or brute forced.  Weak document passwords are unfortunately common, as they need to be memorable.  This allows them to be cracked in seconds or minutes in some cases.

Simply put, then, at best, Google Docs passwords provide partial protection in some scenarios.  It’s far from effective as a catch-all document security solution, especially when you consider the general insecurity of Google Docs and its editing controls, which rely on JavaScript for enforcement.

   How to protect Google Docs without passwords

So, Google document passwords are useless, and, as we’ve covered in previous blogs, so are its copying controls and Google docs watermarks.  If you have an organization that is invested in the Google Workspace ecosystem, what can you do to make it more secure?

Our recommendation would be to move away from Google shared docs entirely.  However, if you must keep it, then the next best thing would be to use it only for collaboration with trusted parties.  Once you have a completed draft of the document, distribute it with a purpose-built document DRM solution instead.

Locklizard Safeguard PDF DRM is one such solution.  It forgoes passwords entirely, instead using a combination of secure file encryption, transparent licensing, and a secure viewer application.  After protection, documents can be safely distributed to users via any method (Google Drive, Slack, Email, etc.) without unauthorized parties being able to view, print, edit, copy, or screenshot them.

Here’s what the process looks like:

1. You encrypt a PDF on your local PC and add any DRM controls you desire.  These can include anti-screenshotting and copying techniques, printing controls, watermarks, device/location locking, and more.  By default, users cannot copy text or images, edit, save or print PDF files.
2. Safeguard saves the protected PDF to your disk as a .PDC file and creates a record of the document on the Admin System.
3. You create a user account for each person who you want to view the document.
4. Users receive an email with a license file and a link to download the Safeguard secure viewer.
5. After installing the viewer, the user clicks the license file to activate it on their device.  Once activated, users cannot register the license file elsewhere (unless otherwise specified).
6. You choose which documents users can access via the Admin System.
7. You send the DRM-protected PDF to users just like any other file (via email, file sharing, messaging, etc.).

Essentially, it doesn’t matter where you store the document or how many times users duplicate it – if a user does not have an authorized device with a valid license file, they can’t view the document.  Additionally, you don’t need to deal with time-consuming passwords since documents are not password-protected, or user management.  Locklizard gives you the ability to assign users to publications and publish documents to everybody in that group.  They’ll automatically be granted access to newly protected documents as long as they have their license file installed on their device.

  How to protect Google Docs with Locklizard

The PDF encryption and decryption process is made simple with Locklizard Safeguard.  You don’t need to worry about creating passwords or key pairs in advance because the licensing system does the heavy lifting for you.

Here’s how you can create a secure PDF in Google Docs by using Safeguard to DRM protect and encrypt PDF files:

1. Right-click your PDF in Windows File Explorer and select “Make Secure PDF”.
   
2. Select the restrictions you’d like to apply, including restricting access after a certain date, which can be found in the “Expiry & Validity” tab.  By default, editing, copying, and printing are disabled.
   
   On pressing the Publish button, Locklizard will output your encrypted PDF file, which can only be opened by users you give access to in the Safeguard Admin portal.  It can’t be edited, and content cannot be copied and pasted. Printing is also blocked by default unless you specifically allow it.
3. Add new users, and/or select existing users you want to give access to your protected PDF files using the cloud-based Safeguard Admin System
   
4. Upload your protected PDF documents to Google Drive if you want, or distribute them via any other method. It doesn’t matter who downloads your encrypted PDF files (.PDC files) as only those authorized will be able to view them.
   

   The best choice for Google Docs protection

A secure encrypted Google Docs alternative

Ultimately, the protection systems in place for Google Docs are not fit for purpose.  Even its password protection is not integrated, leading to a time-consuming process that will offer you mediocre security at best.  With the addition of security controls that are easily bypassed, you’d be right to wonder whether it’s worth using Google Docs at all.

Locklizard allows businesses to place strong safeguards on key documents after the collaboration process is over.  It does so in a streamlined and secure way that doesn’t use passwords and effectively locks use to authorized devices with strong encryption and licensing controls.  After protection, you can upload your protected PDF files back to Google Docs, your website, or anywhere you wish without needing to worry about unauthorized users gaining access to its contents.

To protect your PDF files from unauthorized viewing, sharing, copying, editing, and printing, take a 15-day free trial of our PDF DRM software.

   FAQs

Can you lock a document in Google docs against copying, editing, and sharing?

In theory, you can lock a document in Google Docs to stop users from sharing, downloading, printing or copying, and add an expiration date to give access for a limited time period.  In practice, however, this copy protection is trivial to remove and is therefore useless.  See How to copy a Google Doc that is protected.

Do Google Docs watermarks stop unauthorized sharing?

No.  Just likes its printing controls, Google docs watermarks can be removed in less than a minute using the browser’s developer console.  Any user who wants to share the document can easily copy and paste or print the document without the watermark.

Is Adobe PDF password protection a good way to protect Google Docs?

No, it is just as flawed as Microsoft Word’s password protection, if not more so.  For effective protection of sensitive information in PDFs, you need to use a PDF DRM system that does not use passwords at all.

Can you protect individual files on Google Docs?

Yes, but not using a built-in tool.  Your two main options are to password protect Google Docs using Microsoft Word or an add-on, or use a PDF DRM solution.

The better choice is the latter, since authorized users can easily provide unauthorized users with the password along with a link to the document.  Locklizard Safeguard does not use passwords, and as a result there is nothing for users to share or remove.

Do I need to protect my GDoc if my employees’ Google accounts have two-factor authentication?

Yes.  Two-factor authentication only helps to stop access by hackers.  It does little to stop intentional leaks, as an authorized user can just provide their 2FA/confirmation code to an unauthorized one.  Additionally, employees will likely have to share Google Docs documents with third-parties at some point, where you do not have control over the security measures of their Google account.

Can you give someone a password to access a Google Doc?

Absolutely.  Google does not stop people from different devices or locations from opening a document, nor does it prevent multiple people from logging into the same account at once.  As a result, sharing a Google account password is a very valid method of leaking documents to outside parties.

Can Google Docs extensions protect my documents?

They can convert the Google Doc to PDF and then produce an encrypted document using a password, but that doesn’t offer real protection as the password can be shared or brute forced.  You will also have to give the add-on access to view, edit, create, and delete the files you protect with it, which could represent a major security and compliance flaw.

How can I password protect a Google Sheet?

This is the same process as creating a password-protected Google Doc.  Google say you can Protect, hide and edit sheets but then say “People can print, copy, paste, and import and export copies of a protected spreadsheet” so the security is useless.  If you want to protect a Google Sheet from editing, copying and sharing, then save it as a PDF and protect it with Locklizard for total protection.

What operating systems does Locklizard support?

We have a document protection app for Windows and a secure viewer app for Windows, Mac, ios, and Android.  Our web viewer supports any OS.