How PDF encryption actually works, AES-256 explained

The PDF format defines two protections, and only one of them keeps anyone out. A user password (often called the open password) encrypts the page content, so no viewer can display anything until the correct password is entered. Owner restrictions are the other kind: the file opens for anyone who has it, and it simply carries flags saying printing, copying, or editing are not allowed. The first is a lock. The second is a request, and the viewer decides whether to honour it.

That distinction explains almost every confusing thing about PDF security, including why some “locked” PDFs can be unlocked in seconds and others cannot be opened by anyone, ever.

Owner restrictions are enforced by the viewer

A restricted PDF is usually encrypted too, but in a way that protects nothing. With no user password set, the key comes from an empty password, so every viewer can derive it and read the pages without asking you for anything. What is left is a set of permission flags. When a viewer greys out the print button on such a file, it is choosing to cooperate with those flags. Software that does not choose to cooperate can read, print, and copy the same pages without breaking anything.

That is not a flaw in any particular tool. It is what the format specifies: permissions are metadata, not cryptography. Our own Unlock PDF strips owner restrictions from a file that opens without a password for exactly this reason. Nothing is being cracked, because there was never a cryptographic barrier to crack.

What a user password actually does

A user password is different in kind. The content is encrypted, and the password is what produces the key that decrypts it. Without the password there is nothing readable in the file, so a viewer cannot show you page one and politely decline to print it. It has nothing to show.

Our Protect PDF tool writes AES-256 encryption at revision 6. The password is never written to our database or logs, which is also why we cannot recover it for you later.

The cipher is not the weak point, the password is

Because the key comes from your password, the strength of the encryption is capped by the strength of what you chose. AES-256 wrapped around a four digit PIN or a common dictionary word is still AES-256, and it is still guessable by someone testing candidates offline against the file.

A long, unique passphrase you have not reused elsewhere is the part that does the real work. This is also why forgotten passwords are a genuine dead end: our Unlock PDF tool needs the password you already know, and no service can recover a properly encrypted file with a strong password, whatever its marketing says.

Which protection does a file have?

Choosing the right one

If your goal is that a stranger who obtains the file cannot read it, only a user password counts, and the full guide to password protecting a PDF walks through choosing and delivering the password. If your goal is to signal that a document should not be reprinted or reused, restrictions communicate that to cooperative readers, and you should assume a determined one ignores them.

Sending the file and the password in the same email puts both halves in one place, which quietly cancels most of the benefit. Use a separate channel for the password when the document actually matters.

Protect PDF encrypts the file on our server, so the copy you upload travels to us unencrypted inside an HTTPS connection and is only locked once it arrives. The protection covers the downloaded copy wherever it goes next, not the upload itself. If you are weighing up whether to upload a sensitive document at all, what happens to a PDF you upload sets out the questions worth asking first.

When this won’t work

• Restrictions will not keep out a determined reader. Any software that can open the file can ignore the permission flags. Treat them as a note, not a barrier.
• A forgotten password cannot be recovered. We never write it to our database or logs, and for a properly encrypted file with a strong password there is no recovery path, from us or from anyone selling one.
• Encryption does not control what happens after opening. A legitimate reader can copy text, screenshot, photograph the screen, or pass on the password. No PDF setting changes that.
• The recipient’s software has to be able to open it. Before you rely on an encrypted file reaching someone, send a test copy and have them confirm it opens on the software they actually use.
• Your policy may forbid the upload regardless. Uploads and results here are deleted automatically about an hour after the upload, and nearer seventy minutes in the worst case, but automatic deletion does not override a workplace, school, legal, or healthcare rule against third-party processing. Use approved local software in that case.