How to Password Protect a PDF: Open Passwords, Permissions, AES

The PDF format defines two passwords, and most confusion comes from treating them as one. The open password, which the specification calls the user password, is the one that matters for privacy. When it is set, every page, image, form field and attachment is encrypted, and the bytes in the file are noise until someone types it. A recipient who forwards the file to the wrong person, or a laptop that gets stolen, exposes nothing as long as the password stays secret.

The permissions password, called the owner password, works differently. It lets the author switch off printing, copying text, filling forms, commenting or editing pages. The document still opens without any prompt, so the reader can see every word. The restrictions are flags stored in the file, and it is up to the viewer to respect them. Acrobat, Chrome, Edge, Firefox and Preview do, and grey out the matching menu items. A viewer or library that chooses to ignore the flags can print and copy anyway, because the content was never hidden from it.

In practice, that gives you three combinations. Use an open password alone for anything private: payslips, tax returns, medical letters, contracts in negotiation. Use a permissions password alone for documents that should be public but are awkward to alter, such as a signed price list. Use both when only named people may read the file and they should not be able to edit it, and make the two passwords different, or anyone who can open the file can also lift the restrictions.

PDF encryption has been revised several times since the first version in 1994, and older methods stay readable for compatibility. The 40-bit RC4 key of PDF 1.1 can be brute-forced on an ordinary computer, and 128-bit RC4 from PDF 1.4 uses a cipher that is no longer considered safe. AES-128 arrived with PDF 1.6 and Acrobat 7. AES-256 came with Acrobat 9, and Acrobat X replaced Adobe's first 256-bit scheme with a stronger password check, which is the version that ISO 32000-2, the PDF 2.0 standard, keeps while deprecating RC4.

For nearly everyone the choice is simple: AES-256. Every current reader on Windows, macOS, iOS, Android and in the major browsers opens it. Drop to AES-128 only when a specific recipient runs software too old for 256-bit files, such as a document management system that has not been updated in fifteen years. In Acrobat, the Compatibility menu makes this choice for you: Acrobat X and later means AES-256, Acrobat 7 and later means AES-128, and anything older means RC4.

You may already own software that can encrypt a PDF. Paid Acrobat Standard and Pro have the most complete controls, including separate open and permissions passwords and the compatibility menu described above. macOS Preview can add both passwords in its export dialog; on recent macOS versions the option sits behind a Permissions button, on older ones it is a single Encrypt checkbox. Word for Windows can encrypt a PDF while creating it, but only with an open password of 6 to 32 characters and without permission settings.

Two common tools have no password feature at all. Microsoft Print to PDF, the virtual printer built into Windows 10 and 11, writes an unprotected file with no security options, and Chrome's Save as PDF destination in the print dialog is the same. If your PDF came from either, encrypt it as a second step. Whatever you use, open the result once and check that it asks for the password; in Acrobat Reader, File > Properties > Security shows the method and the permissions.

On a Chromebook, a work laptop without Acrobat, or a phone, a browser tool does the same job. Password protect the PDF by uploading one file of up to 95 MB; UltKit encrypts it with AES-256 by default and deletes both the upload and the result 30 minutes after processing. There is nothing to install and no account to create, which matters on a locked-down office computer.

Do any other edits first. An encrypted PDF cannot be recompressed or merged without the password, so if the file is too big for an email limit, compress the PDF before you protect it. If it holds filled form answers that must not change, flatten it first as well. Encryption adds only a small security dictionary, so the protected copy is about the same size as the original.

The most common mistake is sending the password in the same email as the attachment, or in a second email a minute later. Anyone who can read that mailbox, including someone who forwards the thread, then has both halves. Use a different channel: email the file and text the password, read it out on a call, or agree on it in person. For a recurring exchange, such as monthly statements to the same client, agree on a password rule once and never write it down in the message.

Choose a password the recipient can type without errors. A passphrase of four or five unrelated words is easier to dictate over the phone than a string of symbols, and it is harder to guess than a name or birth date. Avoid details the recipient's colleagues could look up, and do not reuse your own email or banking password, because you are about to share it with someone else.

Regulated documents raise the stakes. HR files, medical records and legal papers often fall under rules such as HIPAA in the United States, which lists encryption as a safeguard for health data, or Article 32 of the GDPR, which names encryption as an example of appropriate security. An AES-256 open password on an email attachment is a sensible part of that, but it is not the whole of it: your organization may require a secure portal, logging of who received what, or a retention schedule. Check your policy before choosing email at all.

Encryption protects the file at rest and in transit. Once the right person opens it, the content is on their screen, and nothing in the PDF format can stop a screenshot, a phone photo of the monitor, or text recognition run on either. Print restrictions do not survive a viewer that ignores them, and if printing is allowed, printing to a virtual PDF printer can produce an unprotected copy. Treat restrictions as a courtesy to honest readers, not as a defense.

Some details are also visible without the password. The file name is never encrypted, so Smith_HIV_results.pdf reveals what an encrypted body hides; name sensitive files neutrally. With Encrypt metadata turned off, the title, author and keywords can be read by anyone. The email subject, the sender and recipient, the attachment size and the date are visible to every mail server on the way, and a ZIP archive with AES encryption only hides file names when its format supports encrypting them.

When you know the password, removing it is routine. A bank statement you open every week, or a document you encrypted yourself and now need to edit, can be unlocked with the password you know: type it into Current password, press Unlock and keep the unprotected copy somewhere private. To change a password, unlock the file and protect it again with the new one. Remove restrictions only lifts print and copy limits while keeping the open password.

A forgotten open password is a different matter, and the honest answer is short. A PDF encrypted with AES-256 and a strong password cannot be recovered by anyone, including Adobe, because there is no master key or back door. Password-recovery programs work only by guessing, which succeeds against weak passwords and old RC4 files and fails against a long passphrase. Ask the sender for the password or a fresh copy, look for the password rule in the email that delivered the file, and keep your own originals unencrypted in a safe place.

Run through this list once per document. It takes a minute and covers the mistakes that most often undo an otherwise strong setup, from a revealing file name to a password sitting in the same inbox as the attachment.