Why Password Protect a PDF?
A password-protected PDF is encrypted at rest — anyone who gets the file without the password sees nothing but scrambled data. This matters for contracts, financial statements, medical records, and any document where confidentiality matters. The PDF specification supports two kinds of passwords: a user password (needed to open the file) and an owner password (needed to change permissions like printing or copying).
How PDF Encryption Works
PDF encryption has evolved through several revisions, each stronger than the last:
- RC4 (PDF 1.1–1.3): Original encryption, 40-bit keys. Broken decades ago. Still found in legacy systems but offers zero real security.
- RC4 128-bit (PDF 1.4–1.6): Longer key but same broken cipher. Slightly harder to crack but not secure by modern standards.
- AES-128 (PDF 1.6): Secure cipher, reasonable key length. A solid minimum for most use cases.
- AES-256 (PDF 2.0): The current gold standard. 256-bit keys, the same encryption used by governments and banks.
Always choose AES-256 when you can. The performance difference is negligible on modern hardware, and the security margin is vast.
User vs. Owner Passwords
Many people set only an owner password thinking it protects the document. It doesn't. An owner password controls permissions — whether someone can print, copy text, or modify the PDF. The file itself opens without a password. For real protection, set a user password (open password). The owner password is like locking a cabinet but leaving the key in the door.
Print and Copy Permissions
Even with a strong user password, think about what the recipient should do with the PDF once they open it:
- High resolution printing: Allow if the recipient needs a physical copy.
- Low resolution only: Useful when you want to discourage professional reproduction.
- Copy text disabled: Prevents casual copying but won't stop a determined user (screenshots exist).
- Modifications disallowed: Prevents edits to the signed/sealed content.
Remember: permission restrictions are enforced by the PDF reader, not by cryptography. A malicious reader can ignore them. The password is the only real gate.
Password Best Practices
A PDF password is only as strong as the password itself. A 256-bit AES key is useless if the password is "1234":
- Use at least 12 characters with mixed case, digits, and symbols.
- Don't reuse passwords across documents — each PDF should have a unique password.
- Share the password through a different channel than the PDF (email the file, text the password).
- Consider a password manager to generate and store PDF passwords.
Protect a PDF Right in Your Browser
ToolsVito's Protect PDF tool encrypts your PDF with AES-256, lets you set user and owner passwords, and configures print/copy permissions — all processed locally in your browser. No file is ever uploaded to a server.