Password-protecting a PDF: what it protects — and what it doesn't

Sending a salary sheet, a contract, a medical report? A password-protected PDF is genuinely encrypted — with AES, the same family of encryption banks use — and without the password the contents are unreadable. But there are two different "passwords" in PDF, and confusing them is the most common mistake.

Open password vs. permissions password

• An open (user) password is real protection: the document is encrypted and cannot be opened at all without it. This is what Protect PDF sets.
• A permissions (owner) password merely asks viewers nicely not to print/copy/edit. Every serious PDF tool can strip it instantly. Never rely on "printing disabled" as security — it's a checkbox, not a lock.

Doing it right

1. Use a genuinely strong password. PDF encryption is only as strong as the password; "salary2026" falls to a dictionary attack in seconds.
2. Send the password on a different channel than the file. Email the PDF, WhatsApp the password (or say it on a call). If both travel together, one compromised inbox gets both.
3. Check what's actually inside first. A protected PDF still gets forwarded. Run Sensitive Data Detector to see what personal data the document leaks — sometimes redaction, not encryption, is what you really need.
4. Protection happens in your browser here — the unencrypted file never touches a server, which is the whole point when the content is sensitive.

Removing a password

For PDFs you own or are authorised to open, Unlock PDF removes the password (you must know it — this decrypts, it doesn't crack). Useful when a bank statement demands the password on every single open and you're archiving it somewhere already secure.

What encryption can't do

Once someone has the password and opens the file, they can screenshot, re-save, and forward it freely. A password protects the file in transit and at rest — it does not control what a legitimate recipient does afterwards.