How to Password-Protect a PDF (and What Encryption Actually Protects)

The PDF specification defines two distinct passwords, and confusing them is the single most common mistake people make when they think they've secured a document.

The open password (the spec calls it the user password) is required to open and view the file. Enter it wrong and the reader shows nothing but an error — because the page content, images, and text streams are all encrypted. This is the one that matters.

The permissions password (the owner password) does something completely different. It doesn't gate opening the file at all. It sets a handful of permission flags — can this person print, copy text, edit, fill forms, add annotations — and it's the password you'd need to change those settings later. If a PDF has only an owner password and no user password, anyone can open and read it instantly. The 'protection' is entirely a request that the reader chooses to honor.

You can set one, the other, or both. For actual confidentiality, you need the open password. For controlling what a recipient does after they've opened it, you add the permissions password on top — knowing full well those restrictions are soft.

When you set an open password, a modern tool encrypts the PDF with AES-256 — the strongest option in the PDF spec, formally version 5, revision 6 (V5/R6), standardized in PDF 2.0. Under the hood, the file gets a random 256-bit encryption key, and that key is itself locked with a value derived from your password. No password, no key; no key, no readable content.

This is genuinely strong. AES-256 is the same cipher family used to protect classified data and banking traffic. Nobody is brute-forcing the cipher itself. That means AES-256 protects you against exactly one thing extremely well: someone who has the file but not the password cannot read its contents. A stolen laptop, a misdirected email, a leaked cloud backup — the document stays opaque.

What it does not protect against is just as important. Once someone has both the file and the password, encryption is done doing its job — they can open it, screenshot every page, print it, and re-share it freely. Encryption controls access to the file, not what a legitimate viewer does afterward. It also does nothing if your password is weak, because attackers don't attack the cipher — they guess the password.

One more caveat worth knowing: not every 'password-protected' PDF uses AES-256. Older files used RC4 at 128 bits or AES-128, and some very old ones used 40-bit RC4 that's broken in seconds today. If you're the one adding protection, confirm your tool uses AES-256; if you're receiving a 'secure' PDF, its real strength depends on how it was made.

Here's the scenario that trips people up. You open a PDF tool, leave the open-password field blank, set only a permissions password, and check the boxes for 'no printing' and 'no copying.' You download the file feeling like it's locked. It isn't.

Because there's no open password, the file is technically encrypted only with a blank user password, so every reader derives the key and opens it instantly — nothing is actually kept secret. The permission flags are stored in plain view inside the file's encryption dictionary, and they're honored purely on the honor system. Adobe Acrobat and Preview will gray out the print button. But a great many PDF utilities — including free browser tools — simply rewrite the file without those flags, and the restrictions vanish. There's no cracking involved; the data was always accessible.

So permissions-only protection is fine for what it is: a way to signal intent to cooperative software and cooperative people. 'Please don't edit the numbers in this invoice.' It is not security. If a document genuinely must not be printed or copied by a determined recipient, a PDF password cannot deliver that — no PDF tool can, because the recipient's own screen and printer are outside the file's control. That's a job for a dedicated rights-management system, and even those have limits.

The honest rule: use the permissions password as a speed bump and a statement of intent. Use the open password when you actually need the contents kept secret.

The mechanics are the same whether you use Acrobat, Preview, or a browser-based tool. What matters is choosing the open password when confidentiality is the goal.

A privacy note on tooling: many 'online' PDF tools upload your file to a server to do the encryption, which means your document — and sometimes your password — leaves your machine. A better pattern is a tool that runs the encryption in your browser via WebAssembly (qpdf compiled to WASM does exactly this), so the password never travels and the plaintext file isn't sitting on someone else's server. If you're protecting something sensitive, that distinction is the whole point.

Because AES-256 is unbreakable in practice, the password becomes the entire attack surface. Attackers run automated guessing — dictionary words, leaked-password lists, keyboard patterns, and brute force over short strings. Your only defense is a password that's expensive to guess.

Length beats complexity. A random four-word passphrase like correct-battery-harbor-lentil is far stronger and far easier to remember than P@ss1! — the passphrase has vastly more possible combinations, and there's no dictionary attack that catches a random word combination. Aim for at least 12–16 characters, or four-plus unrelated words.

Don't reuse a password you use elsewhere, and don't base it on anything guessable about you or the document (the client's name, the year, 'invoice2026'). If the file will outlive your memory, generate a random password and store it in a password manager — that's genuinely the best practice, not a shortcut.

And think about the delivery channel. Emailing the encrypted PDF and the password in the same message defeats the purpose entirely — anyone reading the inbox gets both. Send the password by a separate channel: a text message, a phone call, a different app.

If you have a PDF you can open — because you know the password — you can produce an unencrypted copy. This is legitimate and common: you protected a file for transit, and now you want a clean version for your own archive, or you need to merge or edit it.

The process is straightforward: open the file with the correct password, then choose the tool's remove-password or decrypt option and save. What comes out is an ordinary, unencrypted PDF. The same browser-based approach applies here — decryption can run locally so the password never leaves your device.

Be clear about the boundary. Removing a password requires knowing the password. There is no legitimate tool that strips an open password you don't have — if the encryption is AES-256, nobody can, which is the whole point. 'PDF password recovery' tools only work by guessing, and against a strong password they simply fail. So the honest answer to 'how do I unlock a PDF I've lost the password to' is usually: you can't, unless the password was weak enough to guess.

Removing a permissions-only password (no open password) is a different story — that's the trivial one-click case described earlier, precisely because there was never an open password sealing the content.