Passwords and permissions on PDF files

PDF encryption offers two passwords and a set of permission flags. They are frequently confused, and the difference matters, because one of them provides genuine protection and the other provides a request.

The open password

Also called the user password. Without it, the document cannot be opened at all. Its contents are encrypted, and no viewer will display them.

This is real cryptographic protection. With modern 256-bit AES and a decent password, a document protected this way is not going to be read by someone who does not have the password.

The owner password

Also called the permissions password. The document opens without it, but changing what readers are allowed to do requires it.

This is where the confusion starts, because the permissions it protects are not enforced by anything except the goodwill of the software reading the file.

Permissions are a request, not a lock

When a PDF says printing is not allowed, that flag is stored in the file. A well-behaved viewer reads it and greys out the print button. That is the whole mechanism.

Software that chooses to ignore the flag simply ignores it. The content is not protected in any meaningful sense; the file is politely asking not to be printed.

This is not a flaw in any particular tool. It is how the specification works, and it is why tools that clear these restrictions exist and are legal to use on your own documents.

What this means in practice

If a document genuinely must not be read by the wrong person, set an open password and share it separately from the file. Emailing a protected document and its password in the same message defeats the exercise entirely.

If you want to discourage casual copying or printing, permissions will do that and no more. Treat them as a signal of intent rather than a control.

Choosing the encryption strength

Use 256-bit AES. 128-bit AES is fine and exists for older readers. The old 40-bit option, which some tools still offer, uses an algorithm that has been broken for years and can be removed in seconds; it exists purely for compatibility with software from the 1990s.

There is no recovery

This is worth being blunt about. A properly encrypted PDF whose password is lost is not recoverable. Password recovery means guessing, at scale, and for a decent password that is not feasible.

Anyone offering to recover a forgotten PDF password is either brute-forcing a weak one or not doing what they claim. Keep the password somewhere you will still have it in two years.

Before you protect a document

Encryption controls who opens the file. It does nothing about what is inside it. If the document contains something the recipient should not see, a password does not help, they have the password. Redact first, then protect.

Choosing a password worth setting

The encryption is only as good as what protects it. 256-bit AES with the password "Passw0rd" is not protected.

Length beats complexity. A passphrase of four unrelated words is both easier to convey over the phone and considerably harder to guess than eight characters of substituted punctuation.

Do not reuse a password you use elsewhere. It will be typed into a document, forwarded, read aloud, and eventually written down.

Getting the password to the recipient

Not in the same message as the file. This is the commonest failure, and it reduces the whole exercise to theatre.

Send the document by email and the password by another route entirely: a phone call, a message, or a channel the recipient already uses. If a mailbox is compromised, an attacker who has the file and the password in one thread has everything.

Where a document goes to many recipients, consider whether a password is the right control at all. A password that twelve people know is a password.

Encryption and everything else

Encrypted files resist most other operations. A document that needs a password to open cannot be merged, compressed, converted or read for text until it is decrypted, and many tools will simply refuse it.

That makes ordering important. Do the editing, then encrypt. If you encrypt first, every subsequent change means decrypting and re-encrypting, and one of those round trips is where the protection quietly gets left off.

For the same reason, encryption and long-term archiving sit badly together. On any horizon long enough to matter, the password will be lost. Protect the storage instead.

What to do about a document you cannot open

If it is yours and you have the password, remove the protection and keep a working copy.

If you have lost the password, the realistic options are the person or system that created the document, or a professional recovery service for something genuinely valuable. Anything promising instant recovery is either brute-forcing a weak password or not doing what it says.

And the thing encryption cannot do

It controls who opens the file. It does nothing about what is inside it. If the document contains something the recipient should not see, a password does not help, because they have the password. Redact first.