PDF offers four different kinds of protection — and three of them are weaker than most people think. This guide separates real cryptography from marketing speak.
Four kinds of protection, from weakest to strongest
- Owner password with 40-bit RC4 — present in files up to Acrobat 5. Trivially breakable in minutes on a laptop.
- Owner password with 128-bit RC4 — Acrobat 6/7. Breakable with a GPU in hours.
- Owner / user password with 128-bit AES — Acrobat 8/9. Strong, but still subject to brute-force on weak passphrases.
- Owner / user password with 256-bit AES (PDF 2.0) — the current gold standard. Infeasible to brute-force without quantum computers.
Owner vs. user password
A user password is what you type to open the file. A owner password enforces permission flags — print, copy, modify. Most tools (including Preview on macOS) respect the flags voluntarily; the encryption key is actually derived from the user password. If no user password is set, the file is not really encrypted, and any decent library can bypass the owner password.
What strong PDF security looks like
- 256-bit AES.
- User password > 12 random characters.
- Metadata encrypted (not just content streams).
- Document delivery over TLS 1.3, not email attachment.
“Removing” passwords
Our Unlock PDF service strips owner passwords from PDFs that have no user password. We do not break user passwords; that would be unlawful. If you forget the password for a file you own, your best legal option is a password manager’s backup.
Beyond passwords: redaction & signatures
Passwords stop casual readers. For real-world security you also need:
- Real redaction that burns the pixels, not a black rectangle over selectable text (which can be removed in seconds).
- Digital signatures (PAdES-B-LTA) that bind the content to a certificate and detect tampering.
- Watermarks (visible or forensic) that identify leaked copies.
Future-proofing
Post-quantum algorithms are coming to PDF via the PDF 2.1 draft. We will add Dilithium and SPHINCS+ signatures as soon as a stable spec ships; follow our newsletter for details.
Checklist for sending sensitive PDFs
- Use 256-bit AES.
- 12+ character random user password; share it out-of-band.
- Redact properly or export to flattened image before redacting.
- Sign with a trusted certificate.
- Deliver via a secure link, not email attachment.
Tags: #PDF password #PDF encryption #protect PDF #AES-256 PDF
Leave a Reply