How to sign a protected PDF: passwords and edit locks

A PDF can be "protected" in three different ways, and they behave differently. The signing tool does not accept an open password: remove it first with the password you were given, then sign. A print and edit lock without a password does not get in the way, but it disappears from the signed file, and the signature takes its place. Putting a password on an already signed file is not an option: the document is rebuilt and the signature drops out of it. The tool does not keep someone else's electronic signature either, so it is designed for the first signature in a document.

A counterparty sends over a contract and asks for it back signed. The file either asks for a password on opening, or opens but the viewer shows "changes not allowed" greyed out, or the signatures panel already holds somebody's signature. In each case "protected" means something different, and so does signing.

The Sign PDF tool accepts one of these files straight away, takes the second only after the password is removed, and does something with the third that you need to know about in advance.

Three kinds of protection that share one name

An open password. The file is encrypted. Without the password not a single page can be read, and no program, our tools included, can process content it cannot see. This is the only protection that genuinely locks a document.

A permissions lock. The file opens at once, but the viewer refuses to print, copy text or make edits. The content is not encrypted: the restrictions are stored as flags, honoured only by software that agrees to honour them. The article on removing protection from a PDF covers this difference in detail.

The other party's electronic signature. The document is not protected in the technical sense, but it is signed: it contains a cryptographic signature covering the whole file. Any later change is flagged by the viewer as a breach, and many viewers also lock editing so that the signature is not broken by accident.

The first two are applied by the sender to control access. The third appears when a document is signed by several people in turn. How each behaves when you sign:

Now each row in turn.

How to tell which protection you have

Viewers display protection differently, and the look of a document does not always tell you what you are dealing with.

An open password cannot hide: any program asks for it before showing the first page. If the file opened without a prompt, there is no encryption, even if the window title says "protected".

A permissions lock is not visible everywhere. Desktop viewers list the restrictions in the document properties and grey out the print and copy buttons. Browser viewers often show nothing and print the file as if nothing were wrong, because for them the restrictions are optional. So the most reliable way to spot a lock is the security section of the document properties, not the buttons.

Someone else's signature shows in the signatures panel, which the viewer usually opens itself the first time it loads a signed file. If the panel is not there, open it by hand: the signature is also reflected in the document properties.

While you are at it, check whether the file contains form fields. Protected documents from banks and portals often turn out to be forms, and forms have their own order of steps, covered below.

An open password: remove it first, then sign

The signing tool rejects an encrypted file and says plainly what to do: remove the password in the unlock tool and upload the file once it opens freely. That is not an interface limitation but a property of encryption: a signature is applied to content, and encrypted content is out of reach.

The order is this. Open Unlock PDF, upload the file, enter the password the sender gave you and download the result: the same document without encryption. Then sign it as you would any other.

Without the password, signing is not possible. Modern PDF encryption cannot be cracked by trying combinations, and no service that "removes the password without the password" exists for it. The only route is to ask whoever protected the file. The sender normally expects the question; the password usually comes in a separate message.

There is a third outcome too: the unlock tool reports not a wrong password but an unsupported encryption method. That is how documents from corporate systems with their own protection scheme look. A password will not help; you need an unprotected copy from the sender.

An edit lock: the signature goes on, the restrictions go away

With a file that opens without a password but blocks editing and printing, the signing tool works straight away. Nothing needs removing: the restrictions do not encrypt the content, and the tool reads the whole document.

What happens next matters. The signed document is rebuilt from scratch, and the restriction flags are not carried over. The signed file opens with no lock on printing or copying. That is not an oversight: instead of a request to "leave this alone", which only well-behaved programs obey, the file now carries a signature that makes any change visible. The protection against edits has become stronger, not weaker.

If it matters to the sender that the print lock survives, raise it with them before you sign. The flags cannot be put back without losing the signature, and the reason is explained below.

Why a signature is more reliable than an edit lock

Senders apply an edit lock so that the contract cannot be altered in transit. A signature solves the same problem by a different means, and the difference is worth understanding so that you can explain it to the counterparty.

An edit lock is a request to the software. It is written into the file, and a well-behaved viewer complies: it refuses to edit, print or copy. Software that ignores the request can do whatever it likes with the file and leaves no trace. A document altered that way is indistinguishable from the original except in content.

A signature is a fingerprint of the file. It does not stop anyone changing the document, but it makes every change visible: the viewer compares the content against the fingerprint and on a mismatch reports that the document was modified after signing. Tampering with the content while keeping a valid signature is not possible.

So the restrictions vanishing from a signed file does not weaken it. The sender wanted the contract not to be altered unnoticed, and the signature guarantees exactly that. The one thing a signature does not do is prevent printing and copying. If the lock was there for that, settle it by agreement, not by a signature.

What the tool applies and what it looks like

The signature has two parts. A visible mark on the last page: name, reason, location and date, positioned on the preview. And an invisible cryptographic signature covering the whole file, mark included.

Three text fields are filled in before signing. An empty field is simply left off the mark: the tool does not make up values for you. Write the name exactly as it appears in the contract. The reason says what the signature means: "Agreed" and "Approved for execution" are different things. The location is optional.

The certificate is issued by the service itself in the name you entered, and it is self-signed. The viewer will show that the document's integrity is intact but that the signer's identity has not been confirmed by a trusted authority. For internal approvals and exchanges with counterparties who know you, that is enough. Where the law requires a qualified electronic signature, you need a certificate from an accredited authority, and an online tool is no substitute for it. How the mark is built, where to place it and what to do about long captions is covered in the article on signing a PDF without a printer or scanner.

If for some reason the cryptographic signature could not be applied, the tool returns the file with the visible mark and a warning that integrity cannot be verified. Sign such a file again rather than sending it.

Why you cannot protect a file after signing it

The most common mistake looks perfectly logical: sign the contract, then put a password on it so that nobody reads it in transit. It does not work, and the reason is technical.

A signature covers the file byte by byte. Password protection in Protect PDF rebuilds the document and encrypts every stream inside it. After that the old bytes are gone, and the signature disappears along with its signature field. What comes out is a password-protected but unsigned document. The viewer will not show a "signature broken" error; it simply will not see a signature at all.

The reverse order does not work either: the signing tool does not accept an encrypted file.

Hence the rule: a signature and an open password cannot be combined in one file with these tools. If you need integrity, sign. If you need confidentiality in transit, put the signed PDF into a password-protected archive or send it through a channel you trust. If the sender delivered an encrypted file and expects one back, talk it through: you can return either a signed file without a password or a password-protected archive with the signed file inside.

If the document is already signed by the other party

The counterparty has signed the contract with their electronic signature and sent it over. You want to add yours and send it back.

The signing tool is not suited to this, and that needs saying plainly. It rebuilds the document to lay down the visible mark, and the other party's signature does not survive the process. The result is a file with your signature and without the counterparty's. Formally you return a signed document; in practice you have destroyed somebody else's signature.

Checking is easy: open the signatures panel in any viewer before and after. If another signature was there before and only yours remains, that is exactly what happened.

What to do instead. Sequential signing, where each new signature is added without rewriting the earlier ones, is what document management systems and desktop applications with incremental signatures are for. Without such a system, each party signs its own copy of the same file and the two are exchanged: two files, one signature in each. Or the counterparty signs last: you sign first, send the file, and they add theirs in a system that keeps yours.

The tool is designed for the first signature in a document. Those are its honest limits.

If the sender expects a protected file back

Quite often a counterparty sends a password-protected contract and asks for it back signed and "in the same form". One file cannot meet both requests, and it is better to say so before they open your reply.

Offer one of two options. First: return the signed PDF without a password and leave protection to the channel it travels through, such as corporate email or a password-protected archive. Second: return the signed file inside an archive with a password you pass on separately, just as they passed on the document password to you. To the recipient the second option looks familiar, and the signature stays intact.

What not to do is quietly put a password on the signed file: the recipient will see a password-protected document with no signature and conclude that you never signed it.

Forms: fill in before signing

If the protected file also turns out to be a form with fields, the order is strict: fill in first, sign second. Filling in after signing changes the document and invalidates the signature.

Fields are filled in with PDF Filler. If the form arrived with a password, remove it first: the filler, like the signing tool, does not work with an encrypted file. Check every value, save the result and only then sign.

Step by step for each case

1. Open the file and identify the protection. It asks for a password: encryption. It opens but will not print: a permissions lock. It opens and the signatures panel already lists a signature: signed by the other party. 2. For encryption, remove the password in Unlock PDF with the password from the sender. For a permissions lock, remove nothing. For someone else's signature, stop and pick one of the approaches above. 3. If the document has form fields, fill them in and save. 4. Open Sign PDF, upload the file, fill in the name and reason, and place the mark in the details block on the last page. 5. Download the result and open the signatures panel: your signature should be there with the status "integrity intact". Do not put a password on this file.

How to check that it all worked

Open the signed file in a viewer with a signatures panel. It should list one signature, yours, noting that the document has not been modified since signing. A note that the signer's identity is unconfirmed is normal for a self-signed certificate, not an error.

Try selecting text on any page: the signed document is still an ordinary PDF with a text layer, not a picture.

If the file came with a print lock, make sure it now prints: that way you see for yourself that the restrictions are gone and will not have to explain it to the recipient after the fact.

And one last check before sending: the file name. The tool suggests its own, and the counterparty expects something recognisable. Rename it so that it is clear the signed version is inside.