Password-protecting a PDF properly

Two locks, very different strength

An open password derives an encryption key from what you type. Without that key the pages are ciphertext, which is why no tool can remove it without the password — not ours, not Adobe, not anyone.

Permission flags work differently. The document is encrypted with an owner password and opens without a prompt, while flags in the file say "do not print" or "do not copy". A viewer that respects those flags will grey out the print button. A viewer that does not, or a script that parses the file, ignores them entirely.

What AES-256 covers

AES-256 is the current standard for PDF encryption and the strongest option the format offers. It protects the content of the document: without the password, the text and images are not recoverable by ordinary means.

It does not protect metadata you leave in place, and it does not stop someone who has the password from sharing the file. Encryption controls reading, not distribution.

There is no recovery

If you forget the open password, the file is gone. That is not a limitation of a particular tool; it is what encryption means. Keep the password in a manager, and keep an unprotected copy somewhere safe if the document matters.

The same fact explains why unlocking a password-protected file requires the password. Removing encryption without the key would mean breaking AES, which is not something a PDF tool can do.

Choosing settings that make sense

For a document sent to a client, set an open password and allow printing. For an internal archive, an open password with copying disabled is reasonable. For anything that must not be redistributed, encryption alone will not do it — you need a system that controls access, not a file.

• Open password: stops reading. Use it whenever the content is sensitive.
• Print and copy flags: advisory. Useful for intent, not for security.
• No recovery: store the password before you send the file.