Password-protecting a PDF is one of the easier security steps you can take, and also one of the most misunderstood. A password keeps casual readers out, but it is not a vault. Before you rely on it for anything sensitive, it helps to know exactly what the encryption does and where it stops.
The two different passwords a PDF can have
PDFs support two separate kinds of password, and people constantly confuse them.
- An open password (also called a user password). Nobody can open the file at all without it. The document content is encrypted, so the bytes on disk are scrambled until the correct password unlocks them.
- A permissions password (also called an owner password). The file opens freely, but certain actions, such as printing, copying text, or editing, are restricted unless someone supplies this second password.
The distinction matters because the two give wildly different levels of protection. An open password genuinely encrypts the file. A permissions password mostly sets flags that ask the reading software to behave. That difference is the whole point of this article.
What an open password actually protects
When you set an open password, modern PDF tools encrypt the document with AES. If the password is strong and the encryption is recent, the file is meaningfully secure. Someone who steals the PDF cannot read it without either the password or an impractical amount of computing effort.
That protection is only as good as the password, though. A short or guessable password can be cracked by software that tries millions of combinations. So the strength of your “encryption” is really the strength of your password plus the secrecy of how you share it. Emailing the PDF and then texting the password in the same thread defeats most of the benefit.
What a permissions password does not protect
This is where people get burned. A permissions password tells compliant PDF readers, “don’t allow printing” or “don’t allow copying.” But the file itself is not necessarily encrypted in a way that enforces those rules. Plenty of free tools will happily strip a permissions password and hand you an unrestricted copy, because the document was never truly locked, only flagged.
So if your goal is to stop someone from copying text out of a document, a permissions password is a speed bump, not a wall. Anyone motivated can take a screenshot, retype the content, or run the file through a tool that removes the restriction. Treat “disable copying” and “disable printing” as polite requests, not guarantees.
Things a password can never do
A few limits apply no matter which password type you use:
- It can’t protect a file after it’s already been opened and saved elsewhere. Once a legitimate viewer decrypts the PDF, they can usually re-save an unprotected version. Encryption guards the file at rest, not the human reading it.
- It can’t track or revoke access. A password is not a login. You cannot change your mind later and lock out someone who already has the password and a copy of the file.
- It can’t prevent screenshots, photos, or retyping. No document format can stop a camera pointed at a screen.
- It can’t hide that the file exists or who it went to. Encryption hides contents, not metadata or the fact of sending.
How to set a password the practical way
Most PDF tools, including the protect feature here, let you add an open password in a few steps: upload the file, type the password, confirm it, and download the protected version. Keep these habits in mind:
- Use the open password, not just permissions, whenever the content genuinely needs to stay private.
- Pick a long passphrase. A few unrelated words are easier to remember and harder to crack than a short string of symbols.
- Send the password through a different channel than the file. The document by email, the password by phone or a messaging app.
- Keep your own unprotected master copy. If you forget the password on an encrypted file, recovery may be impossible. That strength cuts both ways.
Who should skip this entirely
If you are protecting something truly high-stakes, like medical records, legal contracts with regulatory requirements, or financial data for a client, a PDF password alone is the wrong tool. Use a system built for controlled access: an encrypted shared drive, a secure portal, or document software with audit logging and the ability to revoke access. PDF encryption is good for keeping a tax form private from a nosy roommate. It is not a compliance solution.
On the other end, if a document is meant to be read by anyone and you are only adding a permissions password to “discourage” copying, reconsider. It mostly annoys honest readers, breaks accessibility tools that legitimate users rely on, and stops no one who is determined. Leave it open.
The short version
An open password with a strong passphrase and AES encryption is real protection for a file at rest. A permissions password is a suggestion that cooperative software follows. And no password protects content once a trusted person has opened it. Match the tool to the actual risk, and don’t let the padlock icon talk you into a false sense of security.