What PDF password protection actually protects
PDF encryption has two passwords that do very different jobs, and one of them is not really security at all. What each one stops, and what it does not.
A PDF can carry two different passwords, and almost every confusion about PDF security comes from not knowing which one you have.
The two passwords
| also called | what it does | real security? | |
|---|---|---|---|
| User password | open password, document open password | The file cannot be decrypted or read without it | Yes — the content is genuinely encrypted |
| Owner password | permissions password, master password | Sets flags asking readers to forbid printing, copying or editing | No — see below |
The user password is real encryption. Without it the bytes are ciphertext and nobody reads the document.
The owner password is different in kind. The file is encrypted with a key that is derived and stored such that any reader can open it — the restrictions are flags inside the document that say "please do not allow printing." Honouring them is a matter of politeness on the reader's part. Adobe Acrobat honours them. Plenty of other software does not, and removing them requires no cracking, because there is nothing to crack.
Can someone remove PDF printing and copying restrictions?
Yes, trivially, and without knowing the owner password. The restriction is a flag the reader is asked to respect, not a lock. Any tool that chooses to ignore the flag can print, copy and edit the file. Treat owner-password restrictions as a way to signal intent to cooperative software, never as a way to stop a determined reader.
What encryption strength actually means
PDF encryption has been revised several times, and files in the wild still use all of it.
| Revision | Algorithm | Introduced | Status |
|---|---|---|---|
| R2 / R3 | RC4 40-bit and 128-bit | Acrobat 3–5 | Broken. 40-bit is brute-forceable in minutes |
| R4 | RC4 128-bit or AES-128 | Acrobat 7 | RC4 weak; AES-128 acceptable |
| R6 | AES-256 (PDF 2.0, ISO 32000-2) | Acrobat X onward | Current, sound |
If a tool offers you a choice, pick AES-256. If it does not tell you which it uses, assume the worst — a lot of free "protect PDF" utilities still emit RC4-128.
Is an AES-256 encrypted PDF secure?
The encryption itself is sound; the password is the weak point. AES-256 in PDF derives the key from your password, so a short or guessable password is crackable offline at whatever rate the attacker's hardware allows, with no server to rate-limit them. A long random passphrase gives you real security. hello123 gives you none, regardless of the algorithm.
Redaction is not the same thing
Drawing a black rectangle over text in a PDF editor does not remove the text. The characters are still in the content stream underneath the shape, and selecting or extracting the page recovers them. This has produced a long run of public embarrassments involving courts, government agencies and law firms.
True redaction removes the underlying content and is a specific operation in tools that support it. If yours does not say the word "redact," assume you have drawn a rectangle.
How do I know if a PDF was properly redacted?
Extract the text and read it. If the words you expected to be gone come back, the redaction was cosmetic. pdftotext or any text-extraction tool will show you in seconds, and it is worth doing before a sensitive document leaves your hands.
Metadata survives things you would expect to remove it
A PDF carries metadata beyond the visible page: author name, the software that produced it, creation and modification timestamps, and often the full path of the source file on someone's machine. Producing a PDF from a word processor usually carries the document's revision history hints along with it.
Flattening, printing to PDF and re-saving all change which metadata survives, unpredictably. If a document is going outside your organisation, inspect the metadata rather than assuming an export cleared it.
What to use when
- Genuinely confidential document, small audience — user password with a long passphrase, sent over a different channel than the file itself.
- You need to know who opened it — a password cannot tell you that. Host the document behind an access-controlled link that logs views.
- You want to stop casual copying — owner-password restrictions will do that and nothing more. Be honest with yourself that it is a speed bump.
- You need to withdraw access later — encryption cannot do this. Once someone has the file and the password, they have it permanently. Only a hosted link you control can be revoked.
That last point is the one people most often get wrong. A password protects a file in transit and at rest. It does not give you any control after the recipient has opened it, and it cannot be taken back.
Share a PDF the way this one describes
PDFLink turns a PDF into a link you can track, protect with a password and swap the file behind — without the address or its QR code changing. Try it free.