Security 9 min read 13 October 2026

PDF Password and Encryption: Everything You Need to Know

PDF files support two passwords and multiple permission flags — but what do they actually protect? This guide explains how PDF encryption works, the difference between user and owner passwords, AES-256 security, and where PDF password protection falls short.

PDF files support two distinct passwords and a set of permission flags that restrict what readers can do with a document. Open the document in any PDF viewer and you are greeted with a password prompt — but what exactly is protected, and how strong is that protection? The answers are more nuanced than most users expect. The PDF specification (ISO 32000) defines a layered encryption model: one password to open the document, another to change permissions, and a set of flags controlling printing, copying, editing, and form filling. Understanding this model — and its significant limitations — is essential for anyone who sends sensitive PDFs or relies on password protection for document security. This guide covers how PDF encryption actually works, what the two passwords do, the difference between AES-128 and AES-256, permission flags and their real enforcement, and where PDF password protection reliably fails.

Two passwords: open password vs owner password

PDF encryption defines two roles with two separate passwords: **Open password (user password)** — Required to open the document. Without it, the file is completely inaccessible. This is the password you set when you want to restrict who can read your document. The PDF content is genuinely encrypted with AES; without the correct password, the ciphertext is unreadable. **Owner password (permissions password)** — Does not restrict opening the document. Instead, it controls whether the permission flags (printing, copying, editing) can be changed. A PDF with only an owner password can be opened by anyone — the owner password is only needed to use tools that modify permissions. The critical implication: **a PDF with only an owner password is not actually protected from reading**. If someone opens it in a PDF viewer that respects the owner password concept but does not require the open password, they can read the full document. Many online "PDF password remover" tools work precisely by stripping owner-only passwords from PDFs that have no open password. You can set both passwords simultaneously — open password to restrict reading, owner password to restrict permission changes. A PDF with both requires the open password to open and the owner password to modify any permission settings.

AES encryption: PDF 1.4 vs PDF 2.0

The strength of PDF encryption has evolved significantly through PDF versions: **PDF 1.1–1.3: RC4 40-bit** — Trivially broken. Do not use. Crackable in seconds with modern hardware. **PDF 1.4–1.5: RC4 128-bit** — Improved but RC4 has known weaknesses. NIST deprecated RC4 in 2015. Should not be used for sensitive documents. **PDF 1.6: AES-128** — First AES version. Reasonable security for non-critical documents. Key space is 2¹²⁸. **PDF 1.7: AES-256 (Revision 5)** — Introduced in PDF 1.7 Extension Level 3. However, this revision had a significant flaw: the password verification mechanism was weak and allowed offline brute-force attacks that bypassed the AES strength. This revision was deprecated. **PDF 2.0 / Revision 6: AES-256 with SHA-256 key derivation** — The current standard. Uses SHA-256-based password hashing with a proper iteration count, eliminating the Revision 5 weakness. This is the correct choice for genuinely sensitive documents. When using Adobe Acrobat to apply passwords, select "Acrobat X and later" or "Acrobat 2017 and later" to ensure AES-256 Revision 6. Older compatibility settings use weaker encryption. Tools for applying AES-256 Revision 6 encryption: - Adobe Acrobat Pro (Tools > Protect > Encrypt) - QPDF: `qpdf --encrypt user-pw owner-pw 256 -- input.pdf output.pdf` - pikepdf (Python): supports AES-256 with Revision 6

Permission flags: what they control and how weak they are

PDF permissions flags are stored encrypted in the file and specify what operations are allowed without the owner password. The flags include: - **Print** — Whether the document can be printed (at full or low quality) - **Modify contents** — Whether the document can be edited - **Copy text/images** — Whether content can be selected and copied to clipboard - **Add/modify annotations** — Whether annotations and form filling are permitted - **Fill in form fields** — Whether interactive form fields can be filled - **Extract content for accessibility** — Whether content can be extracted for assistive technology - **Assemble document** — Whether pages can be inserted/deleted/rotated **The enforcement problem:** Permission flags are only enforced by PDF software that chooses to enforce them. Adobe Acrobat/Reader respects these flags. Many other PDF viewers, command-line tools, and libraries ignore them entirely and allow all operations regardless. QPDF, Ghostscript, and most PDF libraries will happily process a "copy-restricted" PDF as if the restriction did not exist — because without the owner password, they apply their own policy (usually "allow everything"). **The practical implication:** Permission flags provide a soft barrier against casual users in compliant PDF viewers. They provide no meaningful protection against anyone with technical knowledge or a non-compliant viewer. Do not rely on permission flags alone to prevent copying or printing of sensitive content.

Password strength and brute-force resistance

Even AES-256 PDF encryption is only as strong as the password chosen. AES-256 cannot be brute-forced directly, but the password can be. Tools like Elcomsoft Advanced PDF Password Recovery and open-source tools like John the Ripper and hashcat perform dictionary and brute-force attacks against the PDF password hash. With GPU acceleration, current hardware can test billions of guesses per second against PDF Revision 5 (the weak AES-256 variant). PDF 2.0 Revision 6 dramatically slows this by using a proper KDF with iteration counts. Password guidance for truly sensitive PDFs: - Use a random passphrase of at least 12 characters (e.g., from a password manager) - Avoid common words, dates, names, or patterns - Combine uppercase, lowercase, digits, and symbols - Do not reuse passwords from other accounts - Consider that the password must be shared securely with recipients — if you email a password to protect a PDF you email, an attacker with access to your email gets both For documents requiring genuine security, consider sharing through an end-to-end encrypted platform (Signal, ProtonDrive) rather than relying solely on PDF password protection.

PDF passwords and digital signatures: an important distinction

PDF passwords are often confused with digital signatures. They are fundamentally different: **PDF password encryption** — Scrambles the file content with a symmetric key derived from the password. Protects against unauthorised reading (open password) or setting changes (owner password). Does not prove authorship or document integrity. **PDF digital signature** — A cryptographic signature created with the signer's private key. Proves who signed the document and that the signed content has not been modified since signing. Does not restrict reading — the document remains fully accessible. For contracts and regulated documents, digital signatures are the appropriate mechanism — they provide non-repudiation and tamper evidence. Passwords provide access control. A high-security document workflow typically uses both: digital signatures to ensure authenticity and integrity, and encryption (open password) to restrict distribution.

PDF password protection is a useful tool when applied correctly. AES-256 Revision 6 (PDF 2.0) with a strong password provides genuine protection against unauthorised reading. But permission flags are easily bypassed by non-compliant tools, Revision 5 AES-256 has known weaknesses, and no password helps against someone who already received the document legitimately. For truly sensitive content, combine strong encryption with secure delivery channels, digital signatures for authenticity, and — where content must never be accessible — consider whether PDF is the right format at all.

Frequently asked questions

What is the difference between a PDF user password and owner password?

The user password (open password) is required to open and read the document — without it the file is encrypted and unreadable. The owner password controls whether permission flags (printing, copying, editing) can be changed; it does not prevent opening the document if no user password is set. A PDF with only an owner password can be opened by anyone and read freely.

Can encrypted PDFs be cracked?

PDFs using AES-256 with PDF 2.0 Revision 6 key derivation cannot be brute-forced in any practical timeframe with current hardware — provided the password is strong (12+ random characters). Older encryption (RC4, AES-256 Revision 5) is significantly weaker and can be cracked faster. Short or common passwords are vulnerable to dictionary attacks regardless of encryption strength. Tools like hashcat can test billions of guesses per second on older PDF encryption formats.

Do PDF permission flags actually prevent copying?

Only in PDF viewers that choose to enforce them — primarily Adobe Acrobat/Reader. Most PDF libraries, command-line tools (QPDF, Ghostscript, pypdf), and many alternative viewers ignore permission flags entirely. Permission flags are a deterrent for casual users, not a technical barrier against extraction. For genuine content protection, combine encryption with access-controlled distribution — do not rely on copy-restriction flags alone.

How do I remove a PDF password I have forgotten?

If you have forgotten the owner password (permissions password) but can still open the file, you can use QPDF (`qpdf --decrypt input.pdf output.pdf`) or similar tools to produce an unencrypted copy while the file is open. If you have forgotten the open (user) password, recovery depends on the encryption strength and password length — short or common passwords may be recoverable with commercial tools; strong AES-256 Revision 6 passwords are not practically recoverable.

Try it yourself

Everything in this article can be done directly in the free PDFTheGuide editor — no account required.

Protect PDF Sign PDF Redact PDF Open editor