A PDF can carry two passwords, and they do very different things. The open password (the PDF specification calls it the user password) encrypts the content: without it the file is unreadable bytes. The owner password only sets flags such as "no printing" or "no copying", which the reading program is asked to respect. A PDF with only an owner password opens for anyone, and any program that ignores the flags ignores the protection.
So if the point is that nobody but the recipient reads it, set an open password and pick a long one. That is the part that protects anything.
A PDF ready to encrypt with AES-256, in the browser.
One command. It sets an open password, a separate owner password, and AES-256:
qpdf --encrypt --user-password='open-sesame' --owner-password='owner-Kx9' --bits=256 -- report.pdf locked.pdf
Install it with brew install qpdf on a Mac or apt install qpdf on Debian
and Ubuntu; Windows builds are on the
qpdf releases page. The -- closes
the encryption options. The older positional form,
qpdf --encrypt open-sesame owner-Kx9 256 -- report.pdf locked.pdf, does the
same and also worked in qpdf 12.2.0. Check what you got:
qpdf --show-encryption --password='open-sesame' locked.pdf
R = 6
P = -4
User password = open-sesame
Supplied password is user password
extract for accessibility: allowed
extract for any purpose: allowed
print low resolution: allowed
print high resolution: allowed
modify document assembly: allowed
modify forms: allowed
modify annotations: allowed
modify other: allowed
modify anything: allowed
stream encryption method: AESv3
string encryption method: AESv3
file encryption method: AESv3
R = 6 with AESv3 is AES-256, the strongest encryption a PDF can have.
On a Mac: Preview
Preview can do it without installing anything. Apple's steps (Password-protect a PDF in Preview):
- Open the PDF in Preview and choose File › Export…. Give the copy a new name if you want to keep the original unprotected.
- Click Permissions….
- Tick Require Password To Open Document, and type the password twice.
- Under Owner Password, type an owner password twice. It can be the same as the open password or a different one.
- Click Apply, then Save.
The checkboxes in the same sheet (Printing, Copying Text or Graphics, Inserting, Deleting or Rotating Pages and the others) are the owner restrictions: a ticked one is allowed without the owner password. For a PDF that is already protected, File › Edit Permissions… changes the passwords and the checkboxes.
We read those labels from macOS 26.5.1's own interface files rather than
clicking through the sheet. The sheet belongs to PDFKit, Apple's PDF framework,
and PDFKit on the same Mac wrote AES-128 (R = 4, AESv2), not AES-256.
There is no practical attack on AES-128. If a policy asks for AES-256, use qpdf
or the browser tool.
What each password actually protects
We protected the same three-page report each way, then asked qpdf 12.2.0 to decrypt the result without a password:
| Route | Encryption | Opens without a password | qpdf --decrypt with no password |
|---|---|---|---|
qpdf --bits=256, open password |
AES-256 (R 6) | No | invalid password |
| Protect PDF (browser) | AES-256 (R 6) | No | invalid password |
| Preview / PDFKit, open password | AES-128 (R 4) | No | invalid password |
| Owner password only, everything restricted | AES-256 (R 6) | Yes | Unrestricted copy written |
qpdf --bits=128, RC4 |
RC4 (R 3) | No | Refused to write it at all |
The fourth row is the one to understand. That file was encrypted with AES-256 and every restriction was switched on, and it still protected nothing:
qpdf --decrypt restricted.pdf free.pdf
qpdf --show-encryption free.pdf
File is not encrypted
No password was asked for. A copy-restricted file doesn't stop text extraction
either: pdftotext restricted.pdf - (poppler 25.03) printed the report's first
lines straight away. An empty open password means the key to the content is in
everyone's hands. The restrictions only work in programs that choose to obey
them. Preview does, and says "Without the proper password, you do not have
permission to print this document"; qpdf and pdftotext didn't.
RC4, the cipher in old PDFs, is broken, and qpdf 12 won't write it unless you
pass --allow-weak-crypto: "refusing to write a file with RC4, a weak
cryptographic algorithm". If a PDF you were sent shows R = 2 or R = 3 and no
AESv lines, it uses RC4.
qpdf --show-encryption reports the encryption even when you don't know the
password. It prints Incorrect password supplied, then the R = line and the
encryption method. R = 6 and AESv3 is AES-256, R = 4 and AESv2 is
AES-128.
Protect PDF asks for one password and uses it for both the open password and the owner password. Whoever types that password to open the file is therefore the owner, and gets every permission back: qpdf reports "Supplied password is owner password" on our file with printing, copying and editing all switched off. Nobody can open the file without that password, so in practice the switches restrict no one. If you need people who can open the file to be unable to print it, use qpdf or Preview with a different owner password, and remember it is still a request, not a lock.
In the browser
- Open Protect PDF and drop the PDF in. It shows the file name and size.
- Type the password in Password and again in Confirm password. The meter under it reads Weak, Fair or Strong. The button stays off until both match and the password has at least four characters.
- Leave the Permissions switches as they are, unless you need them for a viewer that obeys them (see the warning above).
- Press Protect PDF. The encrypted copy downloads straight away, with
-protectedadded to its name.
If it says "Couldn't encrypt this PDF. It may already have a password, so unlock it first.", the file is already encrypted. Remove the old password with Unlock PDF, then protect the unlocked copy.
Choosing the password
AES-256 can't be broken, but a password can be guessed. Anyone holding the file can try guesses on their own computer, as many as they like, and no lockout stops them. So the password is the whole protection: use a passphrase of four or five unrelated words, or a long random password from a password manager.
Send the password a different way from the file. A password in the same email as the attachment protects the PDF from nobody who can read that email. A text message or a phone call is better.
And keep it. There is no recovery: nobody can open the file for you, including us.
Taking a password off again
To remove a password you know, with qpdf:
qpdf --decrypt --password='open-sesame' locked.pdf unlocked.pdf
With the wrong password it stops with qpdf: locked.pdf: invalid password and
writes nothing.
A PDF that needs a password to open: type it in and press Unlock PDF.
Drop the file in and Unlock PDF checks whether it needs a password to open. If
it does, type it and press Unlock PDF; the copy downloads with -unlocked
added to its name. You can use either the open password or the owner password.
If it opens freely, you get Remove restrictions instead, and no password is asked for, for the reason the table shows.
A PDF that opens freely but restricts printing and copying.
A PDF that opens freely but restricts printing or editing loads in our page tools (Merge, Split, Organize and the rest) and shows its thumbnails, but the pages they write from it come out broken. Run it through Remove restrictions first, then use the unlocked copy.
Then send the protected copy, and the password by another route. Keep the unprotected original somewhere only you can reach, or delete it.
