PDF security has two passwords with almost the same name and completely different strength. Choosing the wrong one protects nothing.
The two passwords
This distinction is the whole subject and most guides skip it.
The user password, sometimes called the open password, encrypts the document content. Without it a reader cannot display the file at all. With modern AES-256 encryption and a decent password, this is genuine cryptographic protection.
The owner password, sometimes called the permissions password, leaves the document readable and sets flags: no printing, no copying, no editing, no extraction. These flags are advisory. The specification asks conforming readers to honour them; nothing enforces it, and plenty of readers and command-line tools disregard them entirely.
| User password | Owner password | |
|---|---|---|
| Encrypts content | Yes | No |
| Needed to open | Yes | No |
| Stops copying text | Until opened | Only if the reader cooperates |
| Stops printing | Until opened | Only if the reader cooperates |
| Removable without the password | No | Yes, trivially |
| Real security | Yes | No |
If you have set only an owner password and believe the document is protected, it is not. Anyone who can open it can strip the restrictions with free software in seconds.
Choosing an encryption level
Not all PDF encryption is equal, and older files are often weaker than their owners assume.
- RC4 40-bit — Acrobat 3 era. Breakable in minutes on a laptop. Treat as no encryption.
- RC4 128-bit — Acrobat 5 era. Weakened by known attacks on RC4. Avoid.
- AES-128 — Acrobat 7 era. Still considered sound.
- AES-256 — Acrobat 9 and later. The current default and the right choice.
A modern tool will use AES-256. If you are re-protecting an old document, re-encrypting it upgrades the algorithm — the original weak encryption is not carried forward.
The password is the weak point, not the cipher
AES-256 is not going to be broken. The password chosen for it very often is.
PDF password cracking tools work by guessing, and they guess extremely fast — millions of candidates per second on a consumer graphics card, drawing on leaked password lists and dictionary rules. A memorable word with a number on the end falls in seconds.
Length beats complexity. A four-word passphrase such as correct-battery-anchor-fern is far stronger than P@ssw0rd! and considerably easier to pass along on the phone. The Password Generator produces both styles and shows the entropy, which is the number that actually predicts how long a guess takes.
How you send the password matters more than the password
This is where document security usually fails in practice, and no amount of encryption strength compensates.
Emailing an encrypted PDF and then emailing the password to the same address protects against nothing. Anyone with access to that mailbox — or to the mail server, or to a backup of either — has both halves. The encryption became decoration the moment the key travelled the same channel as the lock.
- Use a different channel. File by email, password by phone call or a messaging app.
- Do not put the password in the filename, which happens more often than anyone would like.
- Agree a shared convention in advance for recurring documents, so nothing needs transmitting at all.
- For one-off sharing, a service that expires the link is usually stronger than an encrypted attachment with a password sent alongside it.
What protection cannot do
Worth being blunt, because a lot of software implies otherwise.
Once a legitimate reader has opened the document, they can read it. Everything after that point is a speed bump. They can screenshot every page. They can retype it. They can run OCR on the screenshots — the Image to Text tool would do it in a minute. Print-to-PDF produces an unrestricted copy of a "no printing" document in most readers.
So encryption answers exactly one question well: can someone who intercepts this file read it? Yes with a strong user password, no otherwise. It answers nothing about what an authorised recipient does next. For that the controls are legal and contractual, not technical — which is why an NDA exists.
Order of operations
Encryption goes last, for the same reason signing does: an encrypted file cannot be read by other tools, so nothing else can process it afterwards.
A compressor cannot compress what it cannot decode. A merge tool cannot merge it. If you protect first and then discover the file is 40 MB, you have to remove the protection, compress, and re-apply it.
The working sequence is: merge, compress, watermark, sign, then encrypt. Each step needs the output of the one before in readable form.
Frequently asked questions
What is the difference between a user and an owner password?
A user password encrypts the file — without it the content cannot be read at all, which is real protection. An owner password only sets permission flags asking readers not to print or copy, and any reader can ignore them. Only the user password provides actual security.
Can PDF password protection be removed?
An owner password can be stripped trivially by anyone who can open the file. A user password cannot be removed without the password itself, provided the encryption is AES and the password is strong — attacks target the password by guessing, not the cipher.
What encryption should I use?
AES-256, which is the modern default. Anything using RC4 — 40-bit or 128-bit, from the Acrobat 3 to 5 era — should be treated as unprotected. Re-encrypting an old document upgrades it; the weak original encryption is not carried forward.
How strong does the password need to be?
Length matters more than complexity. Cracking tools guess millions of candidates a second using leaked password lists, so a memorable word with a number on the end falls immediately. A four-word passphrase is both stronger and easier to read out over the phone.
Can I stop someone copying text from my PDF?
Not reliably. The permission flag is advisory and many readers ignore it. Even with a user password, once an authorised reader opens the document they can screenshot it and run OCR. Encryption protects against interception, not against what a recipient does next.
Should I compress before or after protecting?
Before. An encrypted PDF cannot be read by other tools, so a compressor has nothing to work with. The workable order is merge, compress, watermark, sign, then encrypt — each step needs the previous output in readable form.