The Complete Guide to PDF Security — Passwords, Encryption, and Redaction

PDF Password Types — Open vs Permissions

A PDF can carry two distinct passwords. Most people only know about one.

Open Password (User Password)

Controls access to the file itself. Without this password, the document won't open at all.

Use when: You want to restrict who can view the document.

Permissions Password (Owner Password)

Controls what an authorized viewer can do. The document opens normally but specific actions (print, copy, edit) are restricted until this password is entered.

Use when: You want to share a document but control how it's used.

Permission restrictions are only as strong as the PDF reader enforcing them. Compliant readers (Adobe, most browsers) honor them. Custom or non-compliant tools can ignore them. For truly sensitive content, rely on encryption rather than permission restrictions alone.

PDF Encryption: RC4 vs AES-128 vs AES-256

The password protects the key. The encryption algorithm determines how hard it is to break the underlying data without the key.

Algorithm	PDF Version	Security Level	Notes
RC4 40-bit	PDF 1.1–1.3	Broken	Crackable in seconds with modern tools
RC4 128-bit	PDF 1.4–1.5	Weak	Vulnerable to attacks; avoid for sensitive docs
AES-128	PDF 1.6–1.7	Acceptable	Solid for most business use cases
AES-256	PDF 1.7 ext / 2.0	Strong	Current standard; use this for all new documents

Modern PDF tools default to AES-256 when creating new password-protected PDFs. If you're protecting an older PDF that was already encrypted, check the security properties (File → Properties → Security in Acrobat) to confirm the algorithm — and re-encrypt with AES-256 if needed.

Permission Restrictions and What They Actually Do

When you set a permissions password, you can configure specific restrictions. Here's what each one does in practice:

Printing: Not Allowed

Prevents printing from compliant PDF readers. Does not prevent screen capture.

Printing: Low Resolution Only

Allows printing but limits DPI, making high-quality reproductions harder.

Copying Text

Prevents text selection and copy-paste in compliant readers. Does not prevent manual transcription.

Editing

Prevents document modification, page reordering, annotation, and form field changes.

Form Filling

When editing is disabled, this allows or disables form field completion specifically.

PDF Redaction: The Right Way and the Wrong Way

Common mistake: Drawing a black rectangle or highlight over text does NOT redact it. The underlying text remains in the file and can be selected, copied, or revealed by removing the annotation layer. Numerous government agencies have published accidentally unredacted documents this way.

True redaction permanently removes the underlying text and image data from the PDF file structure. After proper redaction, the blacked-out area contains nothing — not invisible text, not metadata, not annotations over preserved content.

Correct redaction tools

• Adobe Acrobat Pro: Tools → Redact → Redact Text & Images. Always run "Sanitize Document" after redacting.
• Sejda.com: Has a dedicated redaction tool (free tier available).
• LibreOffice Draw: Open the PDF, use shape tools to cover content, then flatten the PDF.
• pdftk (command line): Flatten and strip metadata from redacted PDFs.

Wrong approaches (do not use for sensitive redaction)

• Highlighting text in black via annotation tools
• Adding a filled black rectangle as a comment/markup layer
• Using image editing software on screenshots of the PDF (often loses surrounding text integrity)

After any redaction, verify: open the PDF, select all text (Ctrl+A), paste into a text editor. If any text appears under a redacted area, the redaction is incomplete.

Best Tools for PDF Security in 2026

Tool	Password	Encryption	Redaction	Free?
PDF Mavericks		AES-256	No	Yes — password tool free
Adobe Acrobat Pro		AES-256	Yes (best)	No ($24.99/mo)
Sejda.com		AES-256	Yes	Free (3 tasks/day)
PDF24		AES-256	Basic	Free
pdftk (CLI)		AES-128/256	Manual	Free, open-source
LibreOffice	Via export	AES-256	Manual flatten	Free, open-source

Security Best Practices by Document Type

Legal contracts

Use AES-256 open password for client-facing copies. Add a permissions password to prevent editing. Apply digital signature before distributing. Store the signed copy with the signature embedded, not as a separate file.

Medical records

Use proper redaction (not annotation overlay) to remove patient identifiers when sharing with third parties. AES-256 encryption for storage. Do not use free online tools that upload to servers for documents with PHI (Protected Health Information).

Financial reports

Restrict printing and copying for preliminary drafts. Remove track changes and comment metadata before distributing final versions. Run Adobe Acrobat's "Sanitize Document" feature on all externally distributed files.

Internal forms

Lock the form structure with a permissions password while allowing form filling. This prevents recipients from adding content outside form fields while still letting them complete the document.

Frequently Asked Questions

What's the difference between an open password and a permissions password?

An open password (also called a user password or document open password) is required just to open the file. A permissions password (owner password) controls what an authorized viewer can do with the document — print, copy text, edit, or fill forms. A PDF can have either or both. The permissions password does not prevent opening the file; it only restricts actions inside it.

Is PDF password protection actually secure?

Password security depends on the encryption standard. PDFs using AES-256 encryption (the current default in Acrobat and most modern tools) are practically unbreakable with a strong password. Older PDFs using RC4 (40-bit or 128-bit) are vulnerable to brute-force attacks with commodity tools. Always verify the encryption standard when security matters.

Can a redacted PDF be un-redacted?

Only if the redaction was done incorrectly — for example, drawing a black box over text without actually removing it. Proper redaction permanently deletes the underlying text and image data. When using a redaction tool, always check the output file: select the blacked-out area and try to copy text. If you can copy anything, the redaction failed.

Does a password-protected PDF prevent printing?

Not by default. Adding an open password protects viewing access but doesn't restrict printing. To prevent printing, you need a permissions password with the 'Printing not allowed' restriction set. Note that permission restrictions are enforced by the PDF reader application — technically sophisticated users can bypass them.

What is PDF/A and does it affect security?

PDF/A is an archival standard (ISO 19005) designed for long-term preservation. PDF/A-1 and PDF/A-2 prohibit encryption because encryption could make documents inaccessible if keys are lost. PDF/A-3 and later allow encryption in specific profiles. If your document must be both archived and secure, use PDF/A-3b with AES-256.

Can I remove a password from a PDF without the password?

Only through brute-force attack, which becomes computationally infeasible against AES-256 with a strong password. If you've lost the password to your own document, recovery tools exist for short or simple passwords. For strong passwords, the file is effectively locked. See our guide on removing PDF passwords for when you do know the password.

Password-protect a PDF for free

Add AES-256 password protection to any PDF in your browser — no upload, no account.

Protect PDF Now