Most people assume a password-protected PDF is locked like a safe. The reality is more subtle: PDF encryption has two distinct layers, and understanding them tells you what you're actually getting. A document password (also called a user password) is required just to open the file. A permissions password (an owner password) doesn't stop anyone from opening it — it restricts actions like printing, copying, and editing. Many tools that say they 'protect' a PDF are actually setting only the permissions layer, which is much weaker protection than people expect.
What the two passwords do
- Document (user) password — required to open the file at all. This is the real lock: without the password, a standard PDF reader shows nothing.
- Permissions (owner) password — restricts printing, copying, editing, and filling. But these restrictions are only enforced by well-behaved PDF readers; they are a policy request, not cryptography, and can often be stripped by specialized tools.
- A file can have both, or only one — a file with only a permissions password opens without any prompt.
When you encrypt a PDF with a document password, the content is actually encrypted with AES — the same class of algorithm used for disk encryption. A strong, unique password on that file is genuinely difficult to break. The caveat is the same as everywhere else: 'password123' on a PDF is about as secure as writing the combination on the lock. Use a long random password, and share it through a different channel than the file itself.
The honest limits
- Permissions restrictions are advisory — a determined recipient can often remove them with free tools.
- Screenshots defeat everything — if someone can view the document, they can photograph the screen.
- Password recovery is impossible — PDF encryption has no back door. Lose the password and the file is unrecoverable, which is why you keep a plain copy somewhere safe for yourself.
- Your own copy is unencrypted — protection applies to the copy you share, not retroactively to every copy ever made.
When it's actually worth it
A document password is the right tool for sharing a draft or a deliverable over email where you want to control access — contracts with a client, tax documents, health records. It is not DRM, and it doesn't stop someone from sharing what they received. Use it for confidentiality, not for copy protection.
Protect a PDF, or unlock one you own
ForgePlug's Protect PDF adds a document password with AES encryption, and Unlock PDF removes a password from a file you're authorized to open — both in your browser, so the password never leaves your device.
Open Protect PDFWhat "unlock" actually means
A legitimate unlock tool removes a password by decrypting the file with the password you supply — you need to already know it. That's a genuine, useful operation for a file you're authorized to open but tired of typing the password into, or a document password on your own archive you want removed for convenience. It's a different thing entirely from bypassing a document password you don't have, which real AES encryption doesn't allow through any straightforward means. A tool that claims to "unlock" a PDF without the password is, at best, only removing the weaker permissions-password layer — the print/copy/edit restrictions — which was never real encryption to begin with.
128-bit vs 256-bit AES
Most modern PDF protection tools offer a choice between AES-128 and AES-256 encryption. AES-256 is the stronger, more future-proof option and there's essentially no practical downside to choosing it on any reader from the last decade or so — support is standard. The one place it can matter is genuinely old PDF readers, particularly software predating roughly 2008, which may only understand the older, much weaker RC4 encryption or AES-128 specifically and fail to open an AES-256 file at all. If you know the document needs to open on unusually old software, that's worth checking before assuming the strongest setting is always the safe default.