Password-protecting a PDF: what it does and doesn't do

Adding a password to a PDF is a simple way to keep a document away from people who should not read it, such as a payslip sent by e-mail or a contract stored in a shared folder. But PDF passwords come in two kinds that behave very differently, and knowing which is which helps you decide how much to rely on them.

Two kinds of PDF password

The PDF format defines two separate passwords, and a file can have either or both.

The user password (open password)

This is the password you are asked for when you open the file. Without it, a reader cannot display the content at all, because the document is encrypted and the password is needed to derive the key. This is the one that provides real confidentiality: with modern encryption and a strong password, the content is unreadable to anyone who does not know it.

The owner password (permissions password)

This password controls permissions: whether the document may be printed, whether text may be copied, whether pages may be changed and so on. A file can have permissions set without an open password, in which case anyone can open and read it, but their reader is asked to restrict certain actions.

Here is the important part: permissions are honoured by well-behaved PDF readers, but they are not strong security. Once a person can open a file, the content has been decrypted on their device, and software that chooses to ignore the restrictions can print or copy it anyway. Tools that do exactly that are easy to find. Think of permissions as a polite "please don't print this" sign, useful for discouraging casual copying, not for protecting secrets.

And no permission setting stops someone from taking a screenshot or photographing the screen. If someone can read a document, they can always reproduce it in some form.

Encryption: AES-256 versus older RC4

The password itself is only half the story. What actually protects the content is the encryption algorithm. Over the years, the PDF format has supported several:

• RC4 (40-bit and 128-bit). Used by older PDF versions. 40-bit keys can be broken by brute force on ordinary hardware, and RC4 itself is considered weak today. Files protected this way should not be trusted with anything sensitive.
• AES-128. Introduced later and a big improvement over RC4.
• AES-256. The strongest option in current PDF versions and the one to look for. With a good password, there is no practical way to read the content without it.

Modern PDF readers open AES-256 files without any trouble. Very old software might not, but that is rarely a concern today. If your tool lets you choose, pick AES-256.

Your password is the weakest link

Strong encryption does not help if the password is easy to guess. Someone with a copy of the file can try passwords offline, as fast as their hardware allows, with no lockout after a few wrong attempts. Short or common passwords can be found quickly this way.

Some guidelines for a strong password:

• Length beats complexity. A passphrase of four or five unrelated words, such as lantern-pebble-orbit-cactus, is both strong and easy to type. Aim for at least 12 to 16 characters for anything sensitive.
• Avoid the obvious. Birthdays, names, the company name, "password", "1234" and the file name are the first things an attacker will try.
• Don't reuse passwords from your e-mail, banking or other accounts.
• Use a password manager to generate and remember passwords if you protect files regularly.

A minimum length of four characters is often allowed by tools so that you can use a simple PIN for low-stakes files, but for real confidentiality, go much longer.

Share the password through a different channel

A very common mistake is to e-mail a protected PDF and put the password in the same e-mail, or in a second e-mail sent a minute later. Anyone who can read that inbox gets both. Instead, send the password by another route:

• a text message or messaging app,
• a phone call,
• in person, or
• a password agreed in advance (for example, a recurring scheme the recipient already knows).

Some organisations use a pre-agreed rule, such as a customer number or date of birth, for routine documents like statements. That is convenient but weak, because such details are often known to others. For truly sensitive files, use a random password and a separate channel.

What password protection does not do

• It does not stop a recipient who knows the password from forwarding the decrypted content.
• It does not prove who created the document or that it has not been changed. That is the job of digital signatures, which are a separate feature.
• It does not hide the file's existence or its name. Depending on the tool and settings, some metadata may remain visible; see hidden information in PDF metadata.
• Permissions without an open password do not keep the content private at all.

For marking ownership or confidentiality visibly, a watermark is a complementary option; see watermark best practices.

Removing a password you know

Passwords become a nuisance when you need to open a file repeatedly, merge it with others, or archive it somewhere that is already secure. If you know the password, you can create an unlocked copy: open the file with the password and save it without encryption. Most PDF tools offer an "unlock" or "remove password" function for this. Only do it for files you are entitled to unlock, and store the unlocked copy somewhere appropriately protected.

Note that many processing tools cannot work with an encrypted file at all until it has been unlocked, so unlocking is often the first step before merging, splitting or compressing.

If you forget the password

With AES-256 and a decent password, a forgotten open password is effectively the end of the road. There is no back door and no reset link: that is the whole point of encryption. Services or programs that claim to "recover" passwords can only guess, and against a long, random password guessing will not succeed in any reasonable time.

So before you protect a file:

1. Keep an unprotected original somewhere safe, if appropriate, or
2. Store the password in a password manager.
3. Ask the sender for a new copy if you received a protected file and lost the password.

Doing it on FlexyFiles

To protect a PDF:

1. Open Protect PDF and upload your file.
2. Enter a password (at least 4 characters, but longer is much better).
3. Choose whether to tick "Allow printing" and "Allow copying text".
4. Enter a name under "Save as" and click Run. The protected copy is encrypted with AES-256 and appears in "Your files" for download.

FlexyFiles never stores your password, so it cannot help you recover it. To remove a password you know, use Unlock PDF: upload the file, enter its password and run the step to get an unlocked copy. Unknown passwords cannot be recovered.

In the full workspace at /pdf/app, you can make protection the last step of a chain, for example Merge, then Watermark, then Protect, so the final file is encrypted. Uploaded and generated files are deleted automatically 48 hours after the workspace was last used, and you can remove them earlier with "Delete all files".