PDF security isn't just one thing
"PDF security" actually refers to a few distinct features that often get lumped together. Understanding the difference matters, because each one protects against a different kind of risk.
1. Open password (document encryption)
This requires anyone opening the file to enter a password before they can view its contents at all. The PDF specification supports real encryption here (not just a flimsy lock), meaning a properly password-protected PDF genuinely can't be opened without the correct password using standard PDF software.
2. Permissions password (restrictions)
This is different and often misunderstood: a permissions password lets anyone view the file, but restricts specific actions — printing, copying text, editing content — unless they enter a separate permissions password. It's worth knowing that these restrictions are enforced by compliant PDF software's user interface, not by the file being technically incapable of those actions, so they're a weaker form of protection than encryption that blocks opening entirely.
3. Digital signatures
A digital signature (different from a drawn signature image) cryptographically verifies who signed a document and detects whether it's been altered since signing. This is a higher-assurance form of signing typically used for legally significant documents, distinct from simply drawing a signature image onto a page.
Choosing the right protection for your situation
| Situation | What you need |
|---|---|
| Sending a sensitive document by email | Open password (encryption) |
| Sharing a document but discouraging casual copying | Permissions password |
| Proving a document hasn't been altered since signing | Digital signature |
| Just need a basic signature on a routine document | Drawn or image signature is usually sufficient |
What PDF security doesn't protect against
It's worth being realistic about the limits here. PDF password protection secures the file itself, but doesn't protect the content once someone with the password has opened it — they can still take a screenshot, retype the content, or photograph the screen. PDF security is about controlling initial access and discouraging casual misuse, not creating an unbreakable barrier against a determined and authorized viewer who simply chooses to misuse content they were given legitimate access to.
The encryption standard behind PDF passwords
Modern PDF encryption, when properly applied, uses AES (Advanced Encryption Standard) encryption, the same general category of encryption standard published by NIST (the National Institute of Standards and Technology) and used widely across banking, government, and enterprise security systems. This means a properly encrypted PDF with a strong, unique password is genuinely difficult to break through brute force with current technology — the practical risk is almost always a weak or reused password, not a flaw in the encryption method itself.
Practical security habits beyond the PDF itself
- Send passwords through a different channel than the document itself — for example, email the file but text the password, so an intercepted email alone doesn't grant access
- Use unique passwords per document rather than reusing one password indefinitely
- Remove sensitive metadata if the document's properties (author name, company, edit history) shouldn't be visible to the recipient
- Double-check recipient addresses before sending — password protection only helps if the wrong person can't guess or obtain the password
If you receive a password-protected PDF you need to edit
You'll need the password to open and process it with any tool, including browser-based editors. Once unlocked with the correct password, the file can be edited normally, for example with a PDF editor to add text, signatures or annotations.