PDF Password Protection

PDF password protection uses the encryption built into the PDF standard to control who can open a file and what they can do with it. It is defined in ISO 32000 as the standard security handler.

A PDF can have two passwords. The user password, also called the open password, is required to open and read the file. The owner password, also called the permissions password, controls restrictions on printing, copying text and editing.

Older PDFs used RC4 encryption with 40-bit or 128-bit keys. Current tools use AES, and PDF 2.0 (ISO 32000-2) specifies AES-256.

Open password vs permissions password

	Open password	Permissions password
Needed to view	Yes	No
Controls	Access to the content	Printing, copying, editing
Strength	Strong with AES-256 and a long password	Depends on the reader honoring the flags

A file with only a permissions password opens without any password. Its restrictions are enforced by the reading software, and some software ignores them.

Where PDF password protection is used

• Sending contracts, statements or HR documents by email.
• Sharing screenshot guides that show internal systems.
• Storing personal records on shared drives.
• Distributing drafts that should not be edited.

How PDF encryption works

When a password is set, the tool derives an encryption key from it. Text, images and other content streams are encrypted with that key. A reader that receives the correct open password derives the same key and decrypts the content. Without the password, the content is unreadable. With AES-256, security depends mainly on the length and randomness of the password.

Common mistakes

• Sending the password in the same email as the file.
• Using a short or reused password.
• Relying on permissions restrictions for confidential content.
• Treating a password as redaction. Anyone with the password sees everything in the file.
• Losing the password. There is no recovery for strong encryption.

Turning pages into a PDF?

Export a PDF from Temposhot, then add an open password with AES-256 in the browser with Protect PDF. See save screenshots as PDF on Mac.

Common questions

Is a password-protected PDF safe to email?

With an open password, AES-256 and a strong password shared separately, the content is protected in transit and at rest.

Can I merge protected PDFs?

Unlock them first with the open password, merge, then protect the result.

Sources

• PDF (Wikipedia)
• Advanced Encryption Standard (Wikipedia)

Related resources

• Image redaction: remove sensitive content before protecting the file.
• Documents export: creating the PDF.