What this covers
- Encryption is enforced by mathematics; permissions by convention
- A permission-flagged file is fully readable to anything that ignores the flags
- 'Password recovery' services operate on permission flags, not encryption
- Only encryption belongs in a sentence with the word 'protected'
Ask what it means to password-protect a PDF and you will get two completely different mechanisms described as though they were the same feature at different strengths. They are not related at all, and confusing them is how people end up relying on something that does nothing.
Encryption
A modern encrypted PDF has its content streams encrypted with AES-256, keyed from a password. Without the password, the bytes are ciphertext. No reader can display it, no tool can extract from it, and no amount of computation available to a normal adversary will recover it.
This is worth stating flatly because a great many sites offer to recover or crack PDF passwords, and for a properly encrypted file none of them can. What they actually handle is the other mechanism.
Permission flags
A PDF can also carry a set of flags saying that printing, copying text, editing or annotating should not be permitted. Crucially, the document itself is fully readable. The flags are a note to the reader software.
Well-behaved readers honour them: the print button greys out, text will not select. Anything that chooses not to honour them displays the document normally and ignores the flags entirely. Removing them is a single pass through any tool that rewrites the file.
The test that distinguishes them
Does the document ask for a password before it will open? That is encryption. Does it open immediately but refuse to print or copy? That is a permission flag, and the content is not protected at all.
Side by side
Two mechanisms that share a name and nothing else.
| Encryption | Permission flags | |
|---|---|---|
| Enforced by | Mathematics | The reader, voluntarily |
| Content readable without permission | No | Yes, entirely |
| Removable by a third party | No | Yes, in one step |
| Password needed to open | Yes | No |
| Survives a rewrite of the file | Yes | No |
| Honest description | Protection | A polite request |
The owner password confusion
The specification allows two passwords: a user password that is required to open the document, and an owner password that governs the permission flags. A file can have an owner password and no user password, which is the common case.
Such a file opens with no prompt and carries restrictions. It is encrypted in a technical sense - with a known empty user password - which is why tools can open it without being told anything. That is not a weakness being exploited; it is the document being configured to open for everyone.
What this means for the tools
Unlock PDF on this site requires the password, always, for both cases. Where a file was only permission-flagged, the result panel says so explicitly - that the document was never encrypted and the restriction was a flag rather than a lock.
We think that matters. A tool that removes a restriction while implying it broke something is misrepresenting what it did, and a user who believes their own documents are protected by permission flags has been misled about something that could matter to them.
What to use when
The requirement decides.
Use encryption when
- The contents must not be readable by the wrong person
- The document is genuinely confidential
- You can transmit the password by a separate route
- You accept that a lost password means a lost document
Permissions are only useful when
- You want to signal an intention, not enforce it
- The recipient is cooperative and the restriction is a convenience
- Accidental editing is the risk, not deliberate copying
- You would not be harmed if they were ignored
Neither is the same as a watermark
A watermark is a visible label drawn into the page. It cannot be enforced by anything, it can be cropped off, and its entire value is that it tells a reader what the document is.
That is genuinely useful - a page stamped 'DRAFT' will not be mistaken for a final version. It is not security, and a document whose only protection is a watermark is unprotected.
The three mechanisms
Quick reference
- AES-256 encryption
- Real protection, no recovery
- User password
- Required to open the document
- Owner password
- Governs the permission flags only
- Permission flags
- Honoured voluntarily by readers
- Watermark
- A visible label, croppable
- Flattening
- Makes form entries permanent, not private
Choosing correctly
- Decide whether the requirement is confidentiality or signalling
- For confidentiality, encrypt - nothing else qualifies
- Write the password down before encrypting; there is no recovery
- Send the password by a different route from the file
- Do not rely on permission flags for anything that matters
- Use a watermark to label, never to protect
Questions and answers
Can a PDF password be cracked?
Not a properly encrypted one. AES-256 with a reasonable password is not defeated by guessing. Services claiming password recovery are operating on permission-flagged files, which were never encrypted, or they are lying.
Why does my PDF open without a password but refuse to print?
It carries permission flags and an owner password but no user password. The content is not protected; the reader is honouring a request. Another reader might not.
Is a password-protected PDF safe to email?
The encryption is sound. Everything around it usually is not - a weak password, the password in the same email, or an unprotected copy left in a downloads folder.
Which PDF encryption should I use?
AES-256, which is what modern tools produce by default. Older RC4-based encryption is weak and should not be relied on for anything.
Sources
- ISO 32000-2 - PDF 2.0, encryptionThe standard security handler and permission bits
