PDF encryption uses two distinct passwords with different functions: Open password (User password) — Encrypts the document content. Without the correct password, the file cannot be opened at all. The encryption algorithm is AES-128 (PDF 1.6) or AES-256 (PDF 1.7 and PDF 2.0). AES-256 as implemented in PDF 2.0 is computationally secure; older 40-bit RC4 (PDF 1.1–1.5) is not. Permissions password (Owner password) — Does not encrypt content. Sets restrictions on printing, copying, and editing. This is misleadingly weak: any PDF tool can ignore permissions restrictions if it can open the file. The permissions password prevents compliant PDF viewers from offering certain operations — it does not cryptographically prevent them. Do not rely on permissions restrictions alone to prevent content extraction. For genuine confidentiality, use an open password with AES-256 encryption. The NIST guidelines for AES confirm that 256-bit keys provide long-term security for sensitive documents. After encrypting, share the password through a separate channel — never in the same email as the PDF. Key limitations of PDF passwords: - Passwords can be brute-forced if they are short or common — use a passphrase of at least 16 characters - PDF password encryption protects the file, not the delivery channel — use HTTPS or encrypted email for transit security - Once a recipient has the password and the file, they can create an unencrypted copy

Every PDF contains metadata that describes its creation history. Standard fields include: Title, Author, Subject, Keywords, Creator (authoring software), Producer (PDF generator), CreationDate, and ModDate. Extended XMP metadata may also contain document IDs, processing history, rights management data, and custom properties added by enterprise document systems. Before sharing a PDF externally: 1. **Inspect with ExifTool**: Run exiftool filename.pdf to see all metadata fields. Pay attention to Author (may contain a user's full name or Active Directory username), Creator (reveals software and version — useful for attackers targeting that software), and any custom fields added by your CRM, DMS, or authoring tool. 2. **Strip metadata**: Adobe Acrobat's Document Properties dialog allows manual editing. For bulk stripping, ExifTool can remove all writable metadata with exiftool -all= filename.pdf. Note that some metadata (like embedded fonts) cannot and should not be removed. 3. **Check embedded content**: PDFs can embed attachments (PDF Portfolios), embedded files, and JavaScript. Check for these in Acrobat under Tools > Examine Document. The UK NCSC guidance on metadata in documents recommends stripping metadata from all documents before external sharing as a default practice.

Even a perfectly prepared PDF can be compromised by an insecure delivery method. Common mistakes: Email attachments without encryption — Standard email is not encrypted in transit between all servers. For confidential PDFs, use S/MIME or PGP-encrypted email, or use a secure file sharing service instead of email. Services like Proton Mail provide end-to-end encrypted email with attachment support. Shared links without expiry — Cloud sharing links from Dropbox, Google Drive, or OneDrive that never expire remain accessible indefinitely. Set expiry dates on shared links for sensitive documents. Revoke links once the recipient has confirmed receipt. No access logging — For high-value documents, use a platform that logs who accessed the document and when. Enterprise document management systems (M-Files, SharePoint) provide audit trails. This is often required for legal and compliance purposes. Forwarding risk — PDF permissions restrictions can technically prevent printing and copying in compliant viewers, but cannot prevent a recipient from screenshotting or photographing the screen. For truly sensitive content, consider whether PDF is the right delivery format — or whether an access-controlled web viewer with no download option better meets the security requirement.

If your PDF contains sensitive information that must be removed before sharing — names, account numbers, addresses — apply proper redaction, not a visual overlay. The distinction matters: placing a black rectangle or white box over text leaves the underlying text data in the PDF's content stream. The text remains copyable, searchable, and extractable by any tool that reads the raw PDF structure. True redaction removes the content from the PDF file entirely. After redacting: 1. Select all text (Ctrl+A) and copy-paste into a text editor — confirm the redacted content does not appear 2. Run pdftotext filename.pdf - (using Poppler) and verify the output 3. Inspect metadata for any fields that may contain the redacted information See the complete redaction guide for the full verification workflow and the PDFTheGuide redaction tool for browser-based redaction.