Protect PDF

PDF encryption defines two separate passwords, and confusing them is behind most of the disappointment people have with protected documents. The user password — often called the open password — is the one that actually keeps the document secret. Without it the file cannot be decrypted at all, and what a viewer sees is a prompt rather than a page.

The owner password governs permissions instead. It is what a viewer checks before deciding whether to let someone print, copy text, extract pages or fill in a form, and supplying it grants unrestricted access regardless of what the restrictions say.

You can set either, or both. Both is the usual answer for a genuinely confidential document: the open password controls who reads it, the owner password controls what those readers may then do. Setting only an owner password produces a file anyone can open but not, in a well-behaved viewer, print or copy.

An open password is real security. The document is encrypted with AES-256, the same algorithm used to protect classified material and bank transfers, and no amount of computing power available today will break it. The only realistic attack is guessing the password, which is why the strength of your password is the entire strength of your protection.

Permissions are a different category of thing, and it is worth being blunt about it. A permissions-only PDF is encrypted with an empty password, so any software can decrypt it — the restrictions are honoured because viewers choose to honour them, not because they are enforced. Acrobat, Preview, Chrome and every other mainstream reader respect them. Software written specifically to ignore them exists and is not hard to find.

That does not make permissions useless. They stop a colleague absent-mindedly editing the master copy, make it clear that a document is not meant to be redistributed, and prevent the accidental extraction that causes most real-world leaks. Just do not rely on them against someone who actively wants the content — for that, use an open password, and consider whether the sensitive parts should have been removed with Redact PDF instead.

Because guessing is the only viable attack, password choice is not a formality. Short passwords, dictionary words, names and dates fall to automated guessing quickly, and adding a digit and an exclamation mark to a common word barely slows it down — the guessing tools have known that trick for twenty years.

Length is what actually helps. Four unrelated words strung together are far stronger than eight characters of punctuation soup, and immeasurably easier to type correctly into a prompt on someone else's phone. Better still, generate a random password in a password manager and share it through the manager.

How you transmit it matters as much as what it is. A password sent in the same email as the attachment protects against nothing, since anyone reading the email has both. Send the document one way and the password another — a message, a call, a shared vault — so that intercepting one channel is not enough.

Encryption controls access to a whole document. It cannot hide one paragraph from a reader who is allowed to open the file, and it does nothing about content the document should never have contained. If a contract contains a bank account number that the recipient must not see, protecting the file does not help — Redact PDF removes the content permanently, which is the only thing that does.

It also does not survive conversion. Anyone who can open the document can convert, screenshot or retype it, so encryption is a control on distribution rather than a control on copying. Where the concern is provenance rather than confidentiality — proving a document is yours and has not been altered — Sign PDF is the appropriate tool, and the two work together on the same file.

One practical ordering note: apply encryption last. Most tools cannot read an encrypted PDF, so if you still need to merge, compress, add page numbers or stamp a watermark, do all of that first and protect the finished document.