How to Password Protect a PDF (And What That Protection Really Does)

"Password protected" sounds like one thing. In the PDF specification it is two entirely different mechanisms, and one of them provides essentially no security at all. People routinely pick the weak one and believe their document is safe.

Two passwords, two very different guarantees

The user password: real encryption

Also called the open password or document open password. Set one and the actual content of the file is encrypted. The text streams, the images, the fonts — all of it is ciphertext on disk.

Without the password there is nothing to read. Not "the reader refuses to show it" — there is genuinely no plaintext present. A hex editor shows you noise. This is the real thing.

The owner password: a request

Also called the permissions password. This one sets flags in the document: do not allow printing, do not allow copying text, do not allow editing, do not allow extraction for accessibility.

Here is the crucial part. The content is not protected by these flags. The file opens for anyone, with no password prompt. The document is fully readable. All that stands between a reader and printing it is that their PDF software noticed a flag and chose to honour it.

Software that chooses not to honour it — and plenty exists, including ordinary open-source libraries — simply ignores the flags. Removing an owner password is not really cracking; it is stripping a field from a file that was never encrypted.

So which should you use?

If the goal is only these people should be able to read this, you need a user password. Nothing else provides that.

An owner password is reasonable when your goal is to signal intent to cooperative users — discouraging casual printing of a draft, say. It is a "please don't", and it works on people who were not going to anyway. Treat it as etiquette, not security.

You can set both. A common combination is a user password so only recipients can open it, plus permission flags discouraging printing once they have.

Encryption strength actually matters

PDF encryption has evolved, and older options are genuinely broken rather than merely dated:

• 40-bit RC4 (PDF 1.1–1.3) — broken. Brute-forceable quickly. Present only for ancient compatibility.
• 128-bit RC4 (PDF 1.4) — RC4 itself has known weaknesses and is no longer considered acceptable.
• 128-bit AES (PDF 1.6) — sound.
• 256-bit AES (PDF 1.7 / 2.0) — current best practice, supported by all modern readers.

Choose AES-256 unless you have a specific reason not to. If a tool only offers RC4 options, that tells you something about the tool.

Your password is the weak point, not the cipher

With AES-256 in play, nobody is attacking the encryption. They are attacking the password, because that is enormously easier.

Which means the usual rules apply, and they matter more here than for a website login. A website can rate-limit attempts and lock an account. An encrypted file cannot. Whoever has the file can try passwords locally, as fast as their hardware allows, forever, with nothing to stop them.

So: length over cleverness. A passphrase of four or five unrelated words beats a short string with symbol substitutions, and you can actually remember it. Never reuse a password you use elsewhere. And do not put the password in the same email as the attachment, which is startlingly common and defeats the entire exercise — send it through a different channel.

What protection does not do

Encryption controls access to the file. It does not control what happens after someone legitimately opens it.

A recipient with the password can save an unencrypted copy, screenshot pages, print to a new PDF, or simply retype the content. This is not a flaw in PDF; it is unavoidable for any format you can read. If someone can see it, they can copy it.

The practical implication: password protection is the right tool for data in transit and at rest — a document sitting in an inbox, on a shared drive, on a lost laptop. It is the wrong tool for controlling what an authorised reader does afterwards.

Removing protection you are entitled to remove

Legitimate need for this is common: you set a password months ago and now need to merge the file with others, or your organisation has an archived document nobody can index because it is encrypted.

If you have the password, unlocking is straightforward — supply it, and save out a decrypted copy. Our PDF Tools include both protect and unlock, and both run entirely in your browser, which matters a great deal here: uploading a confidential document and its password to a third-party server to remove encryption rather defeats the purpose of having encrypted it.

Practical guidance

• Use a user password if you actually need the content protected.
• Use an owner password only to signal intent, never as security.
• Choose AES-256; avoid anything RC4-based.
• Favour a long passphrase — offline attacks have no rate limit.
• Send the password by a different channel from the file.
• Accept that an authorised reader can always copy the content.
• Encrypt and decrypt locally rather than uploading sensitive files.