Why a Password-Protected PDF Isn't as Secure as You Think

Type "password protect PDF" into a search bar and every result looks the same: enter a password, get a locked file. But the PDF spec actually defines two separate passwords that do very different jobs, and most people who lock a file down never learn which one they set.

Two passwords, one file

• User password (also called the open password) — required to open the document at all. Without it, a PDF reader can't decrypt the content, full stop. This is real encryption.
• Owner password (the permissions password) — doesn't block opening the file. It's meant to restrict what you can do once it's open: print, copy text, edit, extract pages. The document decrypts and displays normally with no password prompt.

A PDF can have either one alone, both, or the same string for both. Protect PDF sets the same password as both the user and owner password, so opening the file and its permissions are locked together with one secret — which sidesteps the whole problem below, but it's worth knowing that's a deliberate choice, not the only way a "protected" PDF can be built. Plenty of tools (Word's "Restrict Editing" export, for instance) set only an owner password and leave the user password blank.

Why the owner-only password is close to worthless

Here's the part that surprises people: a PDF with only an owner password sets can be decrypted with an empty string. The spec requires the file's content to still be readable by something the moment you open it with no user password prompt — which means the actual decryption key is derivable without knowing the owner password at all. The owner password only exists to compute a permission bitmask (a set of flags: "print: no," "copy: no," "edit: no") that a well-behaved reader checks before greying out a menu item.

Nothing about that bitmask is cryptographically enforced. It's a courtesy flag, not a lock. Any tool that reads the file, ignores the flags, and re-saves it without re-encrypting produces a fully unrestricted copy — no password guessing, no cracking, because there was never a real secret to crack. This is exactly the mechanism behind Unlock PDF: when a file opens fine but has print/copy restrictions, the tool strips them with the password field left blank, because it never needed a password to see the content in the first place.

RC4 40-bit vs. AES-256: encryption strength varies wildly

Even a genuine user password doesn't guarantee much on its own — the strength depends on which encryption the PDF was built with:

• RC4 40-bit (PDF 1.1–1.3 era): the original PDF encryption. A 40-bit keyspace is small enough that dedicated password-recovery tools brute-force it in seconds to minutes, independent of how good your password is, because the key itself is short.
• RC4 128-bit / AES-128 (PDF 1.4–1.6): meaningfully harder, but RC4 has known cryptographic weaknesses as a cipher regardless of key length.
• AES-256 (PDF 1.7 Extension 3 / PDF 2.0): the current standard, and the one modern tools including Protect PDF use. With a long, unique passphrase, brute-forcing this is impractical.

A PDF that says "password protected" gives no indication which of these it's using — a file re-saved by an old scanner or a legacy office tool may still be sitting on 40-bit RC4 today, decades after it stopped being adequate.

When a PDF password actually helps

A genuine user password with strong encryption and a long passphrase does real work: it protects a file sitting on a shared drive, attached to an email, or intercepted in transit. Anyone without the password sees ciphertext, not a document. That's a legitimate, useful guarantee — with two caveats. The password itself is the only thing standing between the file and the world, so a weak or reused one undermines strong encryption underneath it. And if you forget it, there's no recovery: it's real encryption, not a display trick, so there's no reset link to fall back on.

What a PDF password does not do is stop a determined reader from copying or editing a document they can already open — "restrict editing" is a request to the reader software's manners, not a barrier. If your actual goal is "nobody can read this without permission," a real open password does that. If your goal is "nobody can copy my text," no PDF password — old or new, weak or strong — was ever built to guarantee that.