PDF permissions password: what it locks, and what it doesn't

Two passwords, two completely different jobs

A PDF can carry two passwords. They are not a strong lock and a stronger lock. They do different things.

The open password (the spec calls it the user password) encrypts the file. Without it, the contents are unreadable. If you want to keep a document private, this is the one that matters.

The permissions password (the owner password) sets restrictions on a file that anyone can already open. Block editing, block printing, block copying text out. The recipient reads it fine, they just get a greyed-out button.

You can set either, or both. If a PDF opens straight away but won't let you edit it, you are looking at a permissions password. If it asks for something before showing a single page, that is the open password. I covered the practical side of undoing each in how to remove a password from a PDF and, from the editing angle, in changing a secured PDF, so I'll stay on the question that gets skipped: how much protection is a permissions password really giving you?

A permissions password is a request, not a lock

Here is the bit that surprised me when I first read it properly. According to the Wikipedia entry on PDF, the user password encrypts the file while the owner password does not. It relies on the software opening the file to respect the restrictions. The same page notes that an owner password can easily be removed by software, including some free online services, and that most freeware and open source PDF readers ignore the permission restrictions entirely.

Read that again. The restriction lives in the file as a set of flags, and it only works if the app opening it chooses to honour them.

Adobe's own products do honour them. Plenty of other readers don't. And you have no say in which one your recipient uses.

A permissions password is a polite note on the door, not a lock.

That is not a reason to never use one. It is a reason to know what you are buying.

What it's actually good for

I'm not against permissions passwords. They have a narrow, sensible use.

• Stopping accidental edits. A finance team sends a signed-off PDF and doesn't want someone "tidying" a figure by mistake. A restriction does that job nicely.
• Setting expectations. A greyed-out print button tells an honest reader that you'd rather they didn't. Most people respect that.
• Keeping a controlled source intact inside your own team. Legal owns the wording, sales shouldn't be touching it, and everyone is on Acrobat anyway.

All of those assume a cooperative reader. None of them assume someone who wants to copy your pricing table.

What it's not good for

If the reason you reached for a permissions password was any of these, it won't hold.

• Keeping the contents private. Anyone with the file can read it. Use an open password, and send that password by a different route from the file. I wrote the steps in how to password protect a file.
• Stopping a forward. Restrictions travel with the file, and so does the file. There is more on why in how to stop people forwarding a PDF.
• Protecting a confidential deal document. If a leak would actually hurt, a flag that any lenient reader ignores is the wrong tool.

Years of sending decks and proposals in growth roles taught me this the slow way. I used to treat "no printing, no copying" as a security measure. It was closer to a comfort blanket. The documents that mattered needed a different approach altogether.

Choosing between the options

It helps to ask what you are actually trying to prevent.

The last row is the one people miss. Once a PDF is an attachment, it is out of your hands for good. You can't take it back, and you can't change who has it.

When the file shouldn't leave your hands at all

If the real worry is who sees the document and for how long, stop thinking about the file and think about the link.

Sending a PDF as a hosted link means the reader views it through a page rather than keeping their own copy. You can set an expiry on that link, and you can revoke it if you change your mind or sent it to the wrong person. That is a different kind of control from a restriction flag, because it works whichever app the reader happens to use. I go through how in sharing a PDF as a link.

I build LiveDocument, so you can see where I'm heading. It does this: upload the PDF (or an image), share one link, expire or revoke it, and see which pages people spent time on. If you want to know how that fits with tracking, PDF tracking software is the longer version. It does not do watermarking or NDA gating, and it won't strip a password from your file, so you need an unlocked copy to upload. And a link isn't magic: a reader can still screenshot a page or take notes. It simply gives you a way to close the door later, which an attachment never does.

For the wider question of whether email is the right channel at all, the answer is in is it safe to send documents over email.

Common questions