The term “encrypt” is technically imprecise in cryptography, but it has become common usage for describing PDF encryption. The technical distinction matters: encrypting a document means applying a symmetric algorithm (AES, RC4) with a key derived from a password. Its strength depends on the algorithm, the security handler revision, and the secret’s length—not on the software that labels it “protected.”
PDF encryption algorithm: AES-256 Revision 6 and what the file version doesn’t tell you
The ISO 32000-2:2017 (PDF 2.0) standard deprecates older security mechanisms and provides for AES-256 with Revision 6 of the security handler. A tool that displays “PDF 2.0” does not necessarily apply this level of encryption. Check the document’s security properties to verify the algorithm actually used and its revision number.
RC4 40-bit and RC4 128-bit, still offered by some free utilities, can be cracked in minutes on ordinary hardware. AES-128 withstands a conventional brute-force attack, but AES-256 Revision 6 remains the standard to aim for with any document containing sensitive data.
We recommend always opening the encrypted PDF in a reader that displays security metadata (Acrobat, PDF-XChange, or certain open-source libraries) and confirming the line “Encryption: AES 256-bit, Revision 6” before sending the file.
Open password and permissions password: two very unequal protections
A PDF can contain two types of passwords. The open password actually encrypts the content: without it, the file remains unreadable. The permissions password (also called the “owner password”) merely tells the PDF reader to prohibit printing, copying, or editing.
The difference is fundamental. A permissions password relies on the software’s cooperation. Third-party tools, including short Python scripts, can remove these restrictions without touching the content. Anyone wanting to know how to encrypt a PDF document reliably should set an open password, not just permissions restrictions.
Using both still makes sense in an internal workflow: the open password protects confidentiality, while the permissions password discourages accidental copying by an authorized colleague. One does not replace the other.
Password strength and transmission: the weak link in PDF encryption
PDF encryption can be cracked offline. Anyone with the file can try passwords without any limit on attempts, unlike a web service that might lock an account after several failures. The direct consequence: a short password can be cracked in a few hours, even with AES-256.
Guidelines for a password that can withstand an offline attack:
- Choose a long, random passphrase (four unrelated words, for example) rather than a short word embellished with symbols. Length matters more than apparent complexity.
- Avoid dictionary words, dates of birth, and usernames reused on other services.
- Generate the password with a password manager (KeePass, Bitwarden, 1Password) and never store it in plain text alongside the file.
Transmitting the secret deserves as much attention as choosing a strong one. Sending the PDF and its password through the same channel (one email, one message) defeats the purpose of encryption. Send the password through a separate channel: SMS, a voice call, or a separate encrypted messaging app.
Metadata and hidden data: what PDF encryption doesn’t conceal
Encrypting a PDF protects its content stream (text, images, annotations). The document’s metadata, however, may remain partially readable depending on the encryption level and the tool’s settings. Title, author, creation software, modification dates: this information can sometimes appear in plain text in a file that is otherwise password-protected.
For documents subject to GDPR or contractual confidentiality obligations, this metadata leak poses a real problem. An author name or network file path visible in the PDF properties can reveal the issuing organization, an internal project name, or a user ID.
Before encrypting, running the document through a tool that removes hidden data (Acrobat Pro offers “Remove Hidden Information”; PDF-XChange has an equivalent feature) is a frequently overlooked step. This removes:
- Document metadata (author, title, keywords, dates)
- Hidden layers and invisible text
- Attachments embedded in the PDF
- Comments and review annotations
- Form data saved in the background
Encrypting without first cleaning the document protects a container that may still leak information through its metadata.
Digital signatures and encryption: complementary, not interchangeable
A digital signature authenticates the sender and guarantees the document’s integrity. It does not encrypt the content. A signed but unencrypted PDF remains readable to anyone who opens it. Conversely, an encrypted PDF without a signature proves nothing about its author’s identity or whether it was altered before encryption.
For sensitive documents (contracts, legal documents, health data), combining AES-256 encryption with a qualified signature meets both needs: confidentiality and authenticity.
Encrypting a PDF is about more than checking a “password protect” box. A verified algorithm, a long password sent separately, purged metadata, and a signature when authenticity matters: each layer addresses a different threat. Neglecting any one of them leaves a gap that the rest of the chain cannot make up for.
