PDF passwords explained
By Dexaloop · Updated 27 October 2026 · Checked against the sources listed below
A PDF can have two different passwords. The open password (also called the user password) encrypts the file, so nobody can read the pages without it. The permissions password (also called the owner or master password) leaves the file readable but asks the reader software to block things like printing, copying or editing. The open password is real protection. The permissions password is only as strong as the software that chooses to respect it.
The two passwords side by side
Adobe's own documentation for its PDF tools defines them this way. The Document Open Password "Prevents users from opening the document unless they type the password you specify." The Permissions Password "Restricts users from printing and editing," and "Users cannot change these security settings unless they type the password you specify." Adobe also notes the two must differ: "You cannot use the same password that is used for Document Open Password."
| Open (user) password | Permissions (owner) password | |
|---|---|---|
| What it stops | Reading the file at all | Printing, copying, editing, depending on settings |
| Can you view the pages without it? | No | Yes |
| Who enforces it | The encryption itself | The reader software, if it chooses to |
| Good for | Payslips, ID scans, medical and legal files | Discouraging casual copying of a published document |
| Real secrecy? | Yes, with a strong password | No |
Why permissions are weak on their own
When a PDF has only a permissions password, the file has to be readable by anyone, so any program can display the pages. Whether it then refuses to print is up to that program. PDFlib, a company that builds PDF software, is blunt about this: "It is up to the developer of PDF tools whether or not access permissions are honored," and "several PDF tools are known to ignore permission settings altogether." It adds that "there is simply no way that a PDF file can make sure it won't be printed while it still remains viewable," and concludes elsewhere that "only PDFs with a user password (required to open the document) are safe from cracking."
So if the content is private, use an open password. Use permissions only as a polite signal.
How strong is the encryption?
The PDF format has used several encryption methods over the years. The current one is AES with a 256-bit key, as defined in PDF 2.0, the international standard ISO 32000-2. PDFlib's comparison lists "AES-256 with improved password handling" for Acrobat X and later and PDF 2.0. Older methods are no longer considered safe: "RC4 no longer offers adequate security and has been deprecated in PDF 2.0," and an earlier AES-256 variant from the Acrobat 9 era is listed as "weak; deprecated in PDF 2.0."
The cipher is not the weak point. The password is. The encryption key is calculated from the password, so someone who has the file can try password after password offline. PDFlib recommends that "Passwords should be longer than 6 characters and should contain non-alphabetic characters," and that they "should not resemble a plain text word."
Worked example: why length matters
Count the possible passwords an attacker would have to try:
- 6 lowercase letters: 26 to the power of 6, about 309 million combinations.
- 8 characters from lowercase, uppercase and digits (62 symbols): 62 to the power of 8, about 218 trillion.
- 12 characters from the same 62 symbols: 62 to the power of 12, about 3.2 × 1021.
Going from 8 to 12 characters multiplies the work by 62 to the power of 4, which is about 14.8 million times. These counts assume random characters. A real word, a name or a birthday is tried early by any guessing program, so "Fatima1990" is far weaker than its length suggests. Four or five unrelated words strung together are both long and easy to type.
What removing a password means
In practice
Removing an open password with the correct password decrypts the file and saves a plain copy. Anyone who gets that copy can read it, so treat it as you would any private document. Removing permissions with the permissions password lifts the print and copy limits. Tools that claim to remove a password you do not know are either guessing (trying many passwords) or, for permissions-only files, simply ignoring the restriction.
In law
This is general information, not legal advice, checked on 27 October 2026 for the United States. Unlocking your own files, or files you were given the password for, is ordinary use. Getting around protection on someone else's work is different. US copyright law, 17 U.S.C. 1201, says: "No person shall circumvent a technological measure that effectively controls access to a work protected under this title," and defines circumventing as including "to decrypt an encrypted work" or to "avoid, bypass, remove, deactivate, or impair a technological measure" without the copyright owner's authority. The law has exceptions, and other countries have their own rules. Contracts, employer policies and data protection duties can also apply. If the file is not yours and you were not given the password, ask the owner.
Common mistakes
- Using only a permissions password for private files. The pages are still readable by anyone.
- Short or guessable passwords. A name and year can be found quickly.
- Sending the password with the file. Use a different channel.
- Losing the password. There is no reset. Keep an unprotected original stored safely.
- Choosing old compatibility settings. Some tools still offer RC4 or 128-bit options for old readers. Pick AES-256.
Protecting a PDF in your browser
Our Protect PDF tool adds an open password using AES-256 and checks that the output really is locked with AES-256 before giving you the file. It runs in your browser, so neither the file nor the password is sent anywhere. It does not add print or copy limits; anyone with the password can use the file normally. There is no recovery if you lose the password, but your original file is left unchanged.
Add an open password with AES-256: pdf.dexaloop.com/protect-pdf/. Free, no sign-up, and it runs on your device.
Questions
Can a PDF password be recovered if I forget it?
Not by the PDF itself. There is no reset link, because the password is part of how the file is encrypted. Keep the password in a password manager, and keep an unprotected original somewhere safe.
Is AES-256 in a PDF actually secure?
The cipher is strong. In practice the weak point is the password: a short or common one can be guessed by trying many candidates. Use a long password with mixed characters.
Why can I open a PDF but not print it?
The file has a permissions (owner) password that sets restrictions, but no open password. Adobe software honors those restrictions, though not every program does; to lift them properly, you need the permissions password from the person who set it.
Is it legal to remove a password from a PDF?
Removing a password from your own file, or one you were given the password for, is normal use. Getting around protection on someone else's copyrighted work without permission can be unlawful; in the US, 17 U.S.C. 1201 prohibits circumventing measures that control access to protected works. This is general information, not legal advice.
Should I send the password in the same email as the PDF?
No. Anyone who gets the email then has both. Send the password another way, such as a text message or phone call.
Sources
- Adobe Experience Manager Forms: Configuring security settings
- PDFlib Knowledge Base: Encryption algorithms and key lengths
- PDFlib Knowledge Base: Permissions
- PDFlib Knowledge Base: Recommendations
- 17 U.S. Code 1201 (Cornell Legal Information Institute)
- Dexaloop Protect PDF tool page
This guide is general information, not legal, tax or financial advice. Rules change; check the official source for your own case. Found a mistake? Email support@dexaloop.com.