Protect a PDF with a Password

How to put a password on a PDF

A contract with figures goes out by email, and a report with personal data sits in a shared folder half the department can open. A password on the file is the simplest measure separating "anyone can read this" from "whoever was given the key can read this".

It matters to grasp the boundary from the start: a password protects against outside eyes, but not against everything at once. What follows sets out what it genuinely gives you and what it only promises.

Two passwords that do different jobs

A PDF provides for two passwords, and confusing them is expensive.

The user password is the one without which the file will not open. That is the real protection. It is mandatory, and it is the one you hand to the recipient.

The owner password is the one that lifts restrictions on actions inside an already-open document: printing, copying text, editing. It is not requested on opening.

In practice the difference looks like this: someone with the user password opens and reads the document but cannot, say, copy text out of it if that is forbidden. Someone with the owner password can do everything.

An empty owner field does not mean "no restrictions"

This detail is not obvious, and it works in your favour.

If you leave the owner password field empty, it is not waived but generated at random. The restrictions stay in force, and nobody can lift them, including you, because the generated value is never shown anywhere.

For most scenarios that is the right behaviour: you hand the recipient one password, the restrictions hold, and no second key wanders around in correspondence. But if you might need to lift the restrictions on this file later, set an owner password deliberately and keep it.

Permission profiles and their honest boundary

There are three profiles: print only (the default), no copying, and full access.

And here begins the thing the service warns about right in the result: encryption and restrictions are of very different reliability.

The password to open is cryptography: the file really is encrypted, and the content cannot be recovered without knowing the password. The restrictions on actions are markers inside the document, a polite request to the viewer. Acrobat and other decent readers honour it. Software that decides to ignore it will copy the text with no obstacle whatsoever.

Practical conclusion: do not rely on a copy ban as protection for a secret. If text must not leave, it cannot be handed over in the document at all, even flagged as "copying forbidden".

What each profile actually permits

The wording in the list is terse, so it is worth unpacking.

Print only, the strictest, is the default. That is a sensible starting point for a document going outside: the recipient almost always just needs to read and print it.

The no-copying profile suits cases where people work with the document, adding comments and filling fields, but should not carry the text away. Full access is for when the task was only to close the file to outsiders, and whoever knows the password should work unimpeded.

Remember all three run into the same boundary described above: these are flags, not locks. The difference between the profiles is real for an ordinary user with ordinary software and vanishes for anyone who deliberately sets out to get around it.

An already-protected file

You cannot put a second password on top of an existing one. A document that demands a password to open is not processed by the tools until the protection is removed.

The order goes like this: unlock-pdf with the old password first, then protect-pdf with the new one. That is also how you change the password on an already-protected file, since there is no separate "change password" operation.

If the old password is unknown, the chain breaks at the first step. It cannot be guessed: unlock-pdf checks the password you supply and does not attempt to brute-force. The encryption here is real, and by construction it has no back way round.

Step by step

1. Open protect-pdf and upload the document. 2. Set the user password, eight characters or more. 3. Leave the owner password empty unless you plan to lift the restrictions yourself. 4. Choose the permission profile to match the task. 5. Download the file and check that it opens with your password.

Always do step five. Sending a counterparty an encrypted file and discovering a day later that the password was wrong stings more than spending half a minute checking.

How to hand over the password

People go wrong here more often than in the settings themselves.

A password sent in the same email as the file protects against nothing. Whoever reached the correspondence reached both at once. It is the most common mistake, and it reduces the whole protection to zero.

The password has to travel by a different channel: the file by email, the password by messenger or spoken aloud. Different channels mean an accidental leak of one does not expose the document.

Do not use data from the document itself as the password. A contract number, a tax ID, a date all sit in the correspondence next to the file and are guessed on the first attempt.

If the file goes to several recipients, remember they will share one password. Tracing who passed it on is impossible. For genuinely sensitive documents, send each recipient their own copy with its own password.

When a password is the wrong tool

A password hides the document as a whole. It cannot hide a part.

If a bank account number has to come out of a contract while the rest is handed over, a password will not help: the recipient opens the file and sees everything. That job belongs to redact-pdf, which removes fragments from the content.

If the document has to be protected from changes rather than from reading, a signature via sign-pdf is closer: it does not stop anyone opening the file but makes any edit after signing visible.

And separately: if you have forgotten the password to your own file, it cannot be recovered. The encryption is real, which means there is no way around. The unlock-pdf tool removes protection from a file whose password is known; it does not work out an unknown one.