Most people assume a password-protected PDF is locked like a safe. The reality is more subtle: PDF encryption has two distinct layers, and understanding them tells you what you're actually getting. A document password (also called a user password) is required just to open the file. A permissions password (an owner password) doesn't stop anyone from opening it — it restricts actions like printing, copying, and editing. Many tools that say they 'protect' a PDF are actually setting only the permissions layer, which is much weaker protection than people expect.
What the two passwords do
- Document (user) password — required to open the file at all. This is the real lock: without the password, a standard PDF reader shows nothing.
- Permissions (owner) password — restricts printing, copying, editing, and filling. But these restrictions are only enforced by well-behaved PDF readers; they are a policy request, not cryptography, and can often be stripped by specialized tools.
- A file can have both, or only one — a file with only a permissions password opens without any prompt.
When you encrypt a PDF with a document password, the content is actually encrypted with AES — the same class of algorithm used for disk encryption. A strong, unique password on that file is genuinely difficult to break. The caveat is the same as everywhere else: 'password123' on a PDF is about as secure as writing the combination on the lock. Use a long random password, and share it through a different channel than the file itself.
The honest limits
- Permissions restrictions are advisory — a determined recipient can often remove them with free tools.
- Screenshots defeat everything — if someone can view the document, they can photograph the screen.
- Password recovery is impossible — PDF encryption has no back door. Lose the password and the file is unrecoverable, which is why you keep a plain copy somewhere safe for yourself.
- Your own copy is unencrypted — protection applies to the copy you share, not retroactively to every copy ever made.
When it's actually worth it
A document password is the right tool for sharing a draft or a deliverable over email where you want to control access — contracts with a client, tax documents, health records. It is not DRM, and it doesn't stop someone from sharing what they received. Use it for confidentiality, not for copy protection.
Protect a PDF, or unlock one you own
ForgePlug's Protect PDF adds a document password with AES encryption, and Unlock PDF removes a password from a file you're authorized to open — both in your browser, so the password never leaves your device.
Open Protect PDF