PDF security is widely misunderstood. Many people assume "password protected" means the same thing across all PDFs, when in reality there are two fundamentally different mechanisms at play — one providing genuine cryptographic security, the other providing only a suggestion of restriction. This guide explains both, and what they actually mean for your documents.
PDF encryption has evolved through several generations, each offering dramatically stronger protection:
PDF 1.1–1.3 (Acrobat 2–4). RC4 cipher. ~1 trillion possible keys.
Can be cracked in seconds on modern hardware. Do not use for any sensitive document.
PDF 1.4–1.6 (Acrobat 5–7). RC4 or AES-128 cipher.
AES-128 remains computationally secure. RC4 variant is weak. Used in many documents created pre-2010.
PDF 1.7 ext / 2.0 (Acrobat 9+). AES-256 cipher.
Considered computationally unbreakable with current technology. The standard for all new PDF security.
The encryption level only matters for the open (user) password — it determines how hard the password is to crack. For owner (permission) passwords, the encryption level is largely irrelevant, as we'll explain below.
Encrypts the entire PDF file content. Without the correct password, the file content is mathematically scrambled and unreadable. Even knowing the encryption algorithm doesn't help — you need the key (derived from the password). This is genuine security.
Who uses it: Securing confidential documents — tax returns, financial statements, medical records, legal agreements.
Does not encrypt the file content. The content remains readable. A flag is set in the PDF metadata restricting certain operations (print, copy, edit). PDF readers enforce these flags — but the content itself is fully accessible to any tool that reads PDFs without following restriction flags.
Who uses it: Publishers, businesses, and individuals wanting to prevent casual copying or unauthorised printing — not for security against determined users.
When a PDF has an owner password set, PDF readers like Adobe Acrobat Reader, Chrome, and Foxit respect the permission flags by:
Crucially, this enforcement is voluntary on the part of the PDF viewer software. A tool that processes PDFs without caring about permission flags — such as Ghostscript, a PDF printer driver, or most PDF conversion tools — simply ignores these flags entirely and processes the content as if there were no restrictions.
Because the content is not encrypted, removing an owner password doesn't require decryption — it requires writing a new copy of the same PDF without the restriction flags. This is exactly what happens when you:
None of these methods need to "crack" anything. They simply read the content (which is available to read) and write it to a new file without the restriction metadata.
| Feature | User Password | Owner Password |
|---|---|---|
| Also called | Open password, document password | Permission password, restriction password |
| Content encrypted? | Yes — mathematically scrambled | No — content is fully accessible |
| Can be opened without password? | No | Yes |
| Removal difficulty | Requires password or brute force | Trivial — any PDF writer removes it |
| Provides real security? | Yes, if strong password | No — only deters casual users |
| Encryption strength matters? | Yes — determines crack resistance | No — content is already readable |
| Good use case | Confidential document protection | Preventing accidental editing in workflow |
| Scenario | Encryption Level | Password Type |
|---|---|---|
| Sharing sensitive financial data | AES-256 (PDF 1.7+) | User password (open) |
| Preventing accidental edits to a form | AES-128 is fine | Owner password (permissions) |
| Distributing read-only reports | AES-256 | Owner password (copy/edit) |
| Client proofs before approval | Any | Owner password (print/copy) |
| Medical or legal records | AES-256 | User password required |
Yes — a PDF can have both simultaneously. In this case, users need the open password to view it, and additionally need the owner password to perform restricted actions. Providing the user password gives read access; providing the owner password grants full permissions on top of that.
AES-128 remains computationally secure against brute force — there are no known practical attacks against the AES algorithm itself at 128-bit key length. However, if the password used to derive the encryption key is weak (short, common, or dictionary-based), the password can be cracked regardless of the encryption strength. The password quality matters more than 128 vs 256-bit for practical security.
Most modern PDF software (Acrobat, LibreOffice, PDFtk, etc.) supports AES-128 and AES-256. Very old PDF readers (pre-2007) may not support AES-256 encryption. If you need your encrypted PDF to be opened by legacy software, AES-128 has broader compatibility while still being secure for most purposes.
Unlock permission-restricted PDFs for printing, editing, and text copying. No sign-up, processed securely.
Open PDF Unlocker →