The difference between password protection and redaction

These two things get treated as interchangeable security measures. They are not remotely the same, and the gap between them is where most accidental disclosures happen.

Password protection is a door

Setting an open password on a PDF encrypts its contents so that a viewer will not display the file without the password. This is real protection against someone who has the file and does not have the password.

It does nothing at all once someone is inside. Every word, every image and every piece of metadata in that document is fully available to anyone who can open it. If you send a protected document to a client and it contains another client's name in a comment, the password has protected nothing that mattered.

Redaction is surgery

Redaction means removing content from the file, not hiding it. This distinction is the entire point, and it is where the well-known failures come from.

Drawing a black rectangle over a name in a PDF editor adds a black rectangle to the page. The name is still there, underneath it, stored as text. Selecting the area and copying it will return the name. Extracting the text layer will return the name. Every year a court filing or a government report goes out with black boxes over text that anyone can retrieve in ten seconds.

Real redaction deletes the underlying content and then draws the box. Anything less is decoration.

What this means in practice

If you need to hand a document to someone but they must not see part of it, a password is the wrong tool entirely. So is a highlighter set to black. You need either a genuine redaction tool that removes content, or, the pragmatic option, and the one most people should use, a version of the document that never contained the sensitive part in the first place.

The metadata problem underneath both

Neither approach touches document properties. Author names, the software used, the original file path, creation timestamps and sometimes the name of the person who last printed it all sit in the metadata. A document can be perfectly redacted in its visible content and still tell you exactly who wrote it, when, and on whose machine.

Clearing metadata takes a few seconds and is worth making a habit before anything goes outside your organisation.

A third thing people confuse with both

Permissions. A PDF can carry flags saying it may not be printed, copied or edited, and viewers generally honour them.

That mechanism is entirely voluntary. The flags are stored in the file and enforced only by the goodwill of the software reading it. Anything that chooses to ignore them does so trivially. Permissions discourage casual copying; they protect nothing.

So there are three separate things, doing three separate jobs: encryption controls who can open a document, permissions politely request certain behaviour from readers, and redaction removes content. Only two of those provide any real security, and only one of them helps if the recipient is the problem.

Working out which you need

Ask who you are protecting the document from.

Someone who should not have it at all. Encryption, with the password sent separately from the file.

A recipient who may see most of it but not all of it, redaction. A password does nothing here; they have the password.

Nobody in particular, but you would rather it were not casually reused, permissions, understanding what they are worth.

The common failure is applying the first when you needed the second.

Checking redaction worked

Do not trust the appearance of the page. Extract the text from the finished document and search it for what you removed. If it appears, the redaction failed regardless of how convincing the black boxes look.

This takes a minute and is the only verification that means anything. It is also the check that would have caught almost every publicised redaction failure of the last decade.

The order to do things in

Redact first, then flatten, then clear the metadata, then encrypt if you need to. Encryption last, because every editing step you take afterwards will require decrypting and re-encrypting, and one of those round trips is where the protection quietly gets dropped.

Metadata sits outside both

Neither encryption nor redaction touches the document properties, and those routinely repeat what was on the page.

A perfectly redacted document can still name its author, the template it came from, and the machine that produced it. An encrypted document reveals all of that to anyone who opens it, which is the person you gave the password to.

Clearing metadata is a third, separate step, and it takes seconds. Make it part of sending rather than something remembered occasionally.

Getting the sequence right

Redact, then flatten, then clear the metadata, then encrypt if you need to.

Encryption goes last because every editing step afterwards requires decrypting and re-encrypting, and one of those round trips is reliably where the protection gets left off. Flattening before clearing metadata matters because flattening writes new metadata of its own.