How to password-protect a PDF properly
· 6 minute read
What a PDF password does and does not do, why permissions are not a lock, how to choose a strong passphrase, and how to send it safely.
People put a password on a PDF for good reasons: a payslip going to an accountant, a scan of a passport going to a solicitor, a contract in a shared folder. The thing worth knowing is that the protection is only as good as three decisions: the password you choose, how you send it, and which kind of protection you apply.
Two kinds of PDF password
A PDF can have an open password, which must be entered to read the file at all, and a permissions password, which controls what a reader may do once it is open: print, copy text, edit. They are different in strength. The open password is real protection, because without it the contents are encrypted and unreadable. The permissions are a set of requests that well-behaved programs respect and that other software can ignore.
So if a document is genuinely sensitive, the open password is the one that counts. "No copying" is a courtesy, not a defence.
What encryption strength means
Modern PDF protection uses AES-256, a standard that is considered strong and that is supported by every mainstream reader released in recent years. At that level, the encryption is not the weak point. The password is. A password that can be guessed or tried quickly makes the strongest cipher irrelevant.
Choosing the password
- Length beats cleverness. A passphrase of four or five unrelated words is far harder to guess than a short string of symbols, and easier to remember.
- Do not use anything that someone who knows you could guess: names, dates, addresses.
- Do not reuse a password from an account. If that one leaks, so does this file.
- Store it in a password manager, because there is no recovery. If you forget it, the file stays locked.
Sending it safely
The most common mistake has nothing to do with encryption. It is to send the password in the same email as the file. Anyone who can read one can read the other, and the protection has been undone. Send the password by a different route: a message on another app, a phone call, or a password agreed in advance.
Check it, and keep a spare
- Open the protected file in another program and confirm that it asks for the password.
- Keep an unprotected copy in a safe place, so that a forgotten password is an inconvenience and not a loss.
- If you also want to remove the hidden author and software details before you protect it, use Remove metadata first.
Taking a password off
Sometimes a protected file needs to be used with something that cannot handle encryption, or it has outlived the reason for its password. If you know the password, Unlock PDF writes out a copy without one. It is not a way past a password nobody knows.
Where it happens matters
A tool that adds the password on a server has to receive both your file and your password in order to do it. A tool that does it in your browser never sends either. Since the whole point is to keep the document private, the second is the more sensible design.
Tools mentioned
- Protect PDF — A password on the file before it leaves your hands.
- Unlock PDF — Take the password off a file you own.
- Remove metadata — Take off the author, the software and the dates the file carries.