Contracts, invoices, medical records, HR files — some documents deserve a lock on the door. Set a password above and your PDF is encrypted, so anyone without it sees nothing but a prompt.
Below: the two different kinds of PDF password and why the difference matters more than people realise, how to send a password without undoing the point of setting one, and where this protection genuinely holds versus where it does not.
PDF supports two separate passwords, and confusing them is the most common mistake in document security.
An open password — sometimes called a user or document-open password — encrypts the file's contents. Without it the document cannot be opened, read, printed, converted or searched by anything. The protection is cryptographic: the bytes are genuinely scrambled, and no tool can process the file without the key.
A permissions password — also called an owner password — leaves the file readable by anyone but marks it as restricted: no printing, no copying text, no editing. The crucial detail is that these restrictions are advisory. They are flags in the file asking readers to behave, and well-behaved software honours them. Software that chooses not to simply ignores them, and the content is fully available because it was never encrypted in the first place.
So if the document is genuinely confidential, use an open password. Permission restrictions are useful for signalling intent — discouraging casual copying from a report, keeping a form from being edited by accident — but they are not a security boundary and should never be treated as one.
Encryption is only as strong as what it protects. A weak password on a strongly encrypted file is a weak file.
Automated cracking tools try dictionary words, names, dates and common substitutions first — millions of guesses per second against a downloaded file, with no lockout and no one watching. Anything that looks like a word, a name, a birthday or a company name is effectively no protection at all.
This is where document security most often falls apart, and it takes ten seconds to get right.
Do not put the password in the same email as the file. It sounds obvious, and it happens constantly. Anyone who intercepts or is wrongly copied on that message has both halves. A forwarded email chain carries the password along with the attachment. Worse, the password often ends up sitting in a mailbox indefinitely, searchable by anyone who later gains access to it.
Send it through a different channel: a phone call, a text message, a messaging app, or in person. This is standard practice in law firms, accountancy and healthcare precisely because it works — an attacker would need to compromise two separate systems rather than one.
One more habit worth adopting: agree the password before sending the file where you can, and change it if the same document goes to a second recipient later.
Being clear about the limits is part of using this properly.
It does not stop a legitimate recipient from sharing. Once someone has the password they can open the file, remove the protection, screenshot it, print it or forward it. Encryption controls who can open a document, not what an authorised person does next.
It does not hide the file's existence or its metadata. Depending on the encryption used, the file name, size and some properties may still be visible.
It does not remove anything from inside the document. Confidential content is still there in full, merely locked. If a particular name or figure should not reach the recipient at all, use Redact PDF to remove it, then protect the result if you also want the whole file locked.
Older PDF encryption is weak. Files protected with 40-bit RC4 from the earliest PDF versions can be broken quickly. Modern AES encryption is the standard to use, and it is what current tools apply.
Protect last. An encrypted PDF cannot be read by any other tool, so anything you still need to do — merging, compressing, signing, numbering — must happen before the password goes on.
If you receive a protected file and need to work with it, open it in a PDF reader with the password, remove the protection, save a copy, and process that. Where you hold the rights to the document but only permission restrictions are in the way, Unlock PDF can clear them.
Unlock PDF removes protection from a document you own, Redact PDF deletes confidential content rather than locking it, Flatten PDF fixes signatures and form values into the page, and Sign PDF comes before you set a password. Browse all PDF tools.