If you're about to email a contract, a medical letter or a spreadsheet of salaries as a PDF, a password is a reasonable extra layer. But only one of the two PDF passwords actually protects anything, and a lot of people set the wrong one.
The short version: set an open password, use AES 256-bit, make the password long, and send it separately from the file. The rest of this guide explains why.
Two passwords, and only one of them encrypts
A PDF can carry an open password and a permissions password.
The open password (called the user password in the PDF spec) is the real lock. The file's contents are encrypted with a key derived from it. Without the password a reader can't decrypt the text or images, so it shows nothing. This is proper encryption, and with a good password it holds up.
The permissions password (the owner password) controls a list of flags: may the reader print, copy text, edit, fill forms, and so on. A file can have permissions without an open password, and then anyone can open it. The catch: to display the page, the reader has to decrypt the content, so it has the decrypted text in memory either way. Whether it then refuses to print is entirely up to the reader app. Adobe Acrobat Reader respects the flags. Many other programs don't, and some PDF tools strip them in a second.
EddiesPDF says as much in the tool itself: "Some readers ignore permission settings." Treat permissions as a polite request. They stop casual copying by people using mainstream apps. They don't stop anyone who wants the content.
Which encryption to choose
Protect PDF offers three options under "Encryption":
- "Strong (AES 256-bit)" is the default and the one you should use. It's the current standard in the PDF format, and current versions of Acrobat Reader, Preview on Mac and the viewers built into Chrome and Edge all open it.
- "Medium (AES 128-bit)" exists for older readers. AES 128 is still sound as a cipher, but the older PDF scheme around it is weaker than the 256-bit version.
- "Medium (RC4 128-bit)" is old and weak. RC4 has known flaws and is only there for very old software that can't open anything else.
I'd only move off AES 256 if the person you're sending to tells you they can't open the file. That's rare now. It mostly happens with old document management systems or embedded viewers on office printers.
How to protect a PDF on EddiesPDF
- Open Protect PDF and add your file.
- Leave "Encryption" on "Strong (AES 256-bit)".
- Tick "Require a password to open the file" and type an "Open password" (at least 4 characters, though you'll want far more than that).
- Optionally set a "Permissions password (optional)" and untick anything under "Allow" you want to restrict, such as "Printing" or "Copying text and graphics".
- Click Protect PDF and download the result.
Encryption happens locally, so the unprotected file is never sent anywhere. To change the password on a file that's already protected, just add it here. You'll be asked for the current password, the file is unlocked in your browser, and the new settings replace the old ones.
If you leave the permissions password empty
If you set restrictions but leave the permissions password empty, a random one is generated and never shown to you. The restrictions then can't be lifted later, not even by you, because nobody knows that password. Usually that's fine (it's exactly what you want for a final copy). If you think you'll need to change the permissions later, set your own permissions password and save it somewhere.
Make the two passwords different. If they were the same, anyone who could open the file would also hold the owner password.
Picking a password that holds up
The encryption is only as strong as the password. AES 256 with the password "1234" falls to a guessing program almost instantly, because the attacker doesn't attack the cipher, they just try passwords.
Length beats complexity. "Tr0ub!e" is short and annoying to type. Four or five random words, like "kettle orbit lantern pickle", is much longer, much harder to guess and easier to read out over the phone. The words need to be actually random, not a phrase that means something to you. A password manager's generator will happily make one.
Avoid the things people use for bank statements: dates of birth, account numbers, postcodes. Those patterns are fine for convenience, but they're the first thing anyone tries.
Send the password a different way
If you email the PDF and put the password in the same email (or the next email in the thread), the protection does almost nothing. Anyone who gets into that mailbox, or gets a forwarded copy, has both.
Use a second channel. Email the file and text the password. Or share the file through Google Drive and say the password on a call. For regular exchanges with the same person, agree a password once in person and reuse it for that relationship only.
What a password doesn't fix
A password controls who can open the file. Once someone opens it, they can see everything in it, including things you might have forgotten were there: a column you hid in the spreadsheet before converting, text under a black box, the document title in the file properties.
If some parts shouldn't be seen even by the recipient, redact them before you protect the file. A black rectangle drawn in an editor doesn't remove the text underneath; Redact PDF does, and the guide on how to redact a PDF properly explains the difference.
Keep an unprotected original
Before you protect anything, keep the original somewhere safe on your own machine. If you lose the open password, there's no recovery. EddiesPDF can't recover it and neither can Adobe; encryption that someone could quietly undo for you wouldn't be worth much. Keeping the original means a forgotten password costs you thirty seconds to re-protect instead of the document itself.
Also useful: Unlock PDF · Redact PDF
