PDF Passwords and Encryption: What Protection You Actually Get

Two passwords, two completely different promises

The USER password (also called the open password) encrypts the document. Without it, the file's contents are ciphertext: no text, no images, nothing readable. This is real cryptography, and with a strong password it is the protection worth having.

The OWNER password does not encrypt anything a reader sees. It sets permission flags: no printing, no copying, no editing. The file itself opens freely; the flags are instructions to the viewing software. Adobe's own products honor them, but nothing in mathematics forces anyone else to, and many tools simply do not.

The practical consequence: if the goal is confidentiality, only the user password matters. Permission flags are a polite request, useful for signaling intent ('please do not edit this contract') but worthless against anyone determined.

What AES-256 actually defends against

Modern PDFs are encrypted with AES-256, the same cipher standardized for government secrets. Against brute force on the cipher itself, the protection is absolute for practical purposes; nobody decrypts AES-256 by trying keys.

The attackable surface is the password, not the cipher. Encryption strength collapses to password strength: 'invoice2024' falls to a dictionary attack in seconds regardless of AES, while four random words survive any realistic attempt. The cipher guarantees that the only way in is the front door; you still choose how good the front-door key is.

Older PDFs are a different story: files encrypted with the legacy RC4 40-bit scheme (common before 2008) can be cracked outright, password or not. If confidentiality matters and the file is old, re-encrypting it with a modern tool is not paranoia, it is maintenance.

The limits no PDF setting can fix

Encryption protects the file at rest and in transit. It does nothing after the recipient legitimately opens it: they can photograph the screen, print to a new unprotected PDF where permitted, retype the contents, or simply share the password along with the file. A password limits WHO opens the document, never what they do with what they saw.

Metadata deserves a special warning: file names, and in some tools the title and author fields, may remain readable even on encrypted files. Naming a confidential file 'layoffs-december-final.pdf' leaks the headline to anyone who sees the attachment list, ciphertext or not.

A sane protection routine

Use a user password with real entropy (a passphrase of several random words beats any pronounceable 8-character string), and send the password through a different channel than the file: file by email, password by message or phone. Sending both in one email protects against exactly nobody.

Match the effort to the stakes. Permission flags are fine for signaling on low-stakes drafts; genuine secrets deserve encryption plus a strong passphrase; and things that must never leak deserve the honest admission that a PDF password is transport protection, not a vault, and perhaps should not be emailed at all.