How to password protect a PDF (and what that actually protects)

A PDF can carry two completely different things that both get called "protection". One is real cryptography. The other is a note asking readers to behave. People mix them up all the time, usually by relying on the second while believing they have the first.

Encryption: the real one

When a PDF is encrypted, its contents are scrambled with a key derived from a password. Without the password the bytes are noise. Modern PDFs use AES-256. AES is the standard published by NIST and the same algorithm that protects online banking, and there is no shortcut through it.

This is real protection. If you set a strong password and lose it, the document is gone. No tool will bring it back.

Permissions: the polite request

Separately, a PDF can carry flags saying "do not allow printing", "do not allow copying", "do not allow editing". These are stored in the document, and whether they are obeyed is up to whatever program opens it.

Adobe Reader honours them. Most commercial readers honour them. A script written in ten minutes does not, and does not need to break anything to ignore them. Permission flags stop honest people doing things by accident. They are not a security control and should never be relied on as one.

User password and owner password

This confuses almost everyone. Both passwords are defined in the ISO 32000-1 PDF specification.

• The user password is needed to open the document at all. This is the one doing the cryptographic work.
• The owner password is needed to change the permissions. A document can have an owner password and no user password. It then opens for anyone, but claims to restrict what they may do.

That second case is where "restricted" PDFs come from: files that open freely but refuse to print. They are not encrypted in any meaningful sense, which is why removing the restriction is trivial and why our Unlock PDF tool can often open one without any password at all.

There is one more trap. If you set a user password and leave the owner password blank, many tools set the owner password to the same value. Then anyone who can open the file also has owner rights, so every permission you set is bypassed by the person you gave the password to. Our Protect PDF tool derives a distinct owner password when you do not supply one, precisely to avoid this.

How to protect a PDF properly

1. Open Protect PDF and choose your file.
2. Set a strong user password. Length beats complexity: a four-word passphrase is stronger and easier to remember than P@ssw0rd!. NIST's password guidelines (SP 800-63B) take the same view.
3. Set a different owner password if the permissions are important to you.
4. Choose what readers may do. Leave accessibility enabled unless you have a specific reason not to.
5. Save, and store the password somewhere that is not the same email as the attachment.

Encryption happens on your own device, so neither the document nor the password is ever transmitted. For a password-protected file this is more than a nice extra. If you send your document to a server to have a password added, the server saw it unprotected.

What a password does not protect against

Once someone can open the document, they can do anything with what is inside it:

• Copy the text by hand, or photograph the screen
• Print to a new PDF, which produces an unencrypted copy
• Forward the file and the password together

Encryption protects a document in transit and at rest, from people who do not have the password. It does nothing about people who do. If information must not reach a particular reader, do not send it to them, or redact it out of the copy that they get.

Redaction is not black rectangles

I will say this plainly, because it has caused real breaches at real organisations: drawing a black box over text in a PDF editor does not remove the text. It draws a rectangle on top of it. The characters are still in the file, and selecting the area copies them out.

Proper redaction removes the underlying content. Our Redact PDF tool rebuilds each page without the matched text present at all, then adds back only the remaining text as a searchable layer. There is nothing left under the black box to recover.

Signing is a separate thing again

Adding a signature to a PDF places an image of your signature on the page. It carries the same legal weight as signing a printout and scanning it, which for most agreements is exactly what is wanted.

It is not a cryptographic digital signature, the kind that certifies who signed and proves the document has not been changed since. That requires a certificate from a trusted authority. If you have been asked for a "digitally signed" PDF in a regulatory context, check which of the two they mean, because they are not interchangeable.