If you have ever password-protected a PDF, you were offered a choice that probably seemed like a minor detail: set a password to open the document, or set one to restrict what people can do with it. Maybe both.
Those two options are not variations on a theme. They are fundamentally different mechanisms, and one of them provides essentially no protection at all. Knowing which is which changes how you should handle confidential documents.
User password: real encryption
The user password — also called the open password — is the one that genuinely protects a document.
When you set it, the PDF's contents are encrypted. The text streams, embedded fonts, and images are scrambled with a symmetric cipher, and the key is derived from your password. Without it, a viewer has nothing to display. There is no page to render, because the page data is mathematically unreadable.
This is real cryptography and its strength depends on which algorithm was used:
| PDF era | Algorithm | Practical strength | |---|---|---| | Acrobat 3–4 (1996–1999) | RC4, 40-bit | Broken. Trivially recoverable with modern hardware. | | Acrobat 5–8 | RC4, 128-bit | Weak. RC4 has known cryptographic flaws. | | Acrobat 7+ (PDF 1.6) | AES-128 | Strong. No practical break. | | Acrobat X+ / PDF 2.0 | AES-256 | Strong. Current standard. |
A modern PDF with a long user password and AES-256 is genuinely secure. The weak link is the password itself, not the cipher — a document encrypted with AES-256 and the password 2024 is not protected by anything meaningful, because attacking the password is vastly easier than attacking the algorithm.
Owner password: an honour system
The owner password — also called the permissions password — works completely differently, and this is where the misunderstanding does damage.
Setting an owner password does not restrict access to the document. The file still opens for anyone, with no prompt. What it does is set a handful of flags in the PDF's encryption dictionary that say things like printing not allowed, copying not allowed, editing not allowed.
Those flags are requests. They are not enforced by cryptography. They are enforced by whichever application happens to be displaying the file, and only if that application chooses to honour them.
Adobe Acrobat honours them, because Adobe wrote the specification and complying with it is the point. Many other viewers honour them too. But nothing makes them. A PDF library written in an afternoon can read the file, ignore the flags entirely, and hand you the fully editable content — not by breaking anything, but simply by not implementing a restriction it was never obliged to implement.
Here is the part that surprises people: on most permission-restricted PDFs, the document content is encrypted with a key derived from an empty user password. The file is technically encrypted, but the key is derivable without any secret at all. That is why removing permission restrictions is instant and requires no password — there is no secret to recover.
What this means in practice
An owner password is a speed bump, not a lock. It stops a colleague from casually copying a paragraph. It does not stop anyone who wants the content. If you are relying on permission flags to protect something that would cause harm if it leaked, you are relying on nothing.
A user password is real protection, and you must not lose it. There is no recovery mechanism. If the password is gone and the cipher is AES, the content is gone with it. This is a feature, not a limitation — a recovery backdoor would defeat the encryption entirely.
This distinction is also why our Unlock PDF tool behaves the way it does. It can remove permission restrictions immediately, because those were never cryptographically enforced. It cannot open a user-password-encrypted file without the password, because the content is genuinely scrambled. Any tool claiming otherwise is either brute-forcing weak passwords, exploiting the legacy 40-bit RC4 flaw, or lying about what it does.
Choosing the right protection
Match the mechanism to the actual threat:
Sending a document over email or a channel you do not control. Use a user password with a strong passphrase, and share that passphrase over a different channel — a phone call, a message app, anything that is not the same email thread. Emailing the password alongside the encrypted file protects against nothing.
Discouraging casual copying of a published document. An owner password is fine here, as long as you understand it is discouragement rather than prevention. A watermark is often more effective, because it survives copying instead of trying to prevent it.
Genuinely confidential material that must not leak. Neither PDF password is the right primary control. Use encrypted transport and access controls at the storage layer, and treat PDF encryption as a secondary measure. A PDF password protects a file in transit; it does nothing about who has legitimate access to the file in the first place.
Long-term archives. Think carefully before applying a user password to anything you need in ten years. Passwords are lost, staff leave, and password managers get abandoned. An encrypted archive with an unrecoverable password is an expensive way to delete your own records.
The one-line summary
If a PDF prompts you for a password when you open it, that is real encryption. If it opens straight away but greys out the print button, that is a request the software is choosing to honour — and other software will not.
