Password-protecting a PDF, explained: what it does and what it doesn’t

If you live in India, you probably open password-protected PDFs every month without thinking about it: bank and credit card statements, Form 16, mutual fund statements, the e-Aadhaar letter. Each one asks for a password before it shows anything. Other PDFs open freely but refuse to let you print or copy text. Both are “password protection”, but they are different features with very different strength.

The two passwords a PDF can have

The open password (user password)

This is the password you type to see the document at all. When a PDF has an open password, its contents are encrypted: the text and images are scrambled using a key derived from the password. Without the password, a PDF reader has nothing readable to show. This is real protection, and its strength depends almost entirely on how good the password is.

The permissions password (owner password)

This second password controls what someone may do with a document they can already open. It is used to set restrictions such as “no printing” or “no copying”, and to lift them later. A PDF can have a permissions password with no open password at all: it opens for everyone, but with some actions switched off.

A file can have one password, the other, or both. If both are set, the open password lets people read the file within the restrictions, and the owner password gives full access.

What AES-256 means

AES is the encryption standard used by banks, messaging apps and operating systems, and 256 is the key length in bits. PDFs have supported several kinds of encryption over the years. Older files sometimes use RC4 or short 40-bit keys, which are weak by modern standards. Current tools should use AES-256, and Pyrbit’s Protect PDF always does.

With AES-256, nobody breaks the encryption itself. Attackers instead try to guess the password: they run through dictionaries of common passwords, names, dates and patterns, very quickly and automatically. So the practical question is not “is AES-256 strong?” (it is) but “is my password easy to guess?”

What print, copy and edit restrictions really do

When you set permissions, you can switch off actions such as printing, high-quality printing, copying text and pictures, editing content, adding comments, filling forms, and inserting, deleting or rotating pages. A separate permission controls whether screen readers can access the text for people with visual impairments; it is good practice to leave that one on.

Here is the honest part. If a PDF opens without a password, every reader program must be able to decrypt it to display it. The restrictions are flags that say “please don’t allow printing”, and well-behaved PDF readers respect them. But software that chooses to ignore those flags can print, copy or edit the document freely, and anyone can take screenshots or photograph the screen. Restrictions are a polite request and a deterrent against casual copying, not a lock.

So use them for what they are good at, such as discouraging people from editing a price list or copying text from a handout. If the content must stay confidential, use an open password.

Choosing a strong password

Many statements in India use passwords built from personal details. The e-Aadhaar letter, for example, uses the first four letters of your name in capitals followed by your year of birth. Formats like this are convenient but weak: anyone who knows your name and birth year can open the file. For documents you protect yourself, do better:

• Make it long. Length matters more than complexity. A passphrase of four or five unrelated words, such as kettle monsoon violet ladder, is far harder to guess than Ravi@1990 and easier to remember.
• Avoid personal details: names, birthdays, phone numbers, vehicle numbers, PIN codes.
• Don’t reuse your email, banking or UPI passwords.
• Store it safely, in a password manager if you use one. There is no “forgot password” for an encrypted PDF.

Share the password separately

Sending the PDF and its password in the same email or chat defeats the purpose: anyone who gets that message gets both. Send the file by email and the password by SMS or a phone call, or agree on it in person.

How to add a password

1. Open the PDF in Protect PDF. The file is encrypted in your browser and is not uploaded.
2. Choose what you want. Pick Password to open to lock the file, or Restrict only so it opens freely but with limits.
3. Type the open password twice if you chose to lock the file.
4. Set permissions if needed. Presets cover Full access, No editing and View only, and you can switch individual actions on or off.
5. Set an owner password. For a restrict-only file it is required, because it is how you lift the restrictions later. For a locked file it is optional; if you turn off some actions and leave it empty, a random owner password that nobody knows is used, so those restrictions stay in place for good.
6. Save, then test. Open the protected copy to confirm the password works before you delete anything or send it.

Removing a password you know

Typing a password every time you open your own statement gets tiresome, and many upload portals reject password-protected files. If you know the password, you can save an unprotected copy:

1. Open the file in Unlock PDF and enter its open password when asked.
2. Save. The new copy opens without a password.
3. For a file that opens freely but has restrictions, enter the owner password if you know it to remove the encryption cleanly. Without it, the pages are copied into a new, unrestricted file; bookmarks and form fields may not carry over.

Removing an open password requires that password; the tool does not guess or crack passwords. Only remove protection from documents you own or are entitled to use. And remember that an unprotected copy is exactly that: keep it somewhere private, and delete it once you have finished with it.

What a password can’t protect against

• The people you give it to. Anyone with the open password can save, print or forward an unprotected copy.
• A weak password, however strong the encryption.
• Information you shouldn’t be sharing at all. If the recipient doesn’t need your account number or PAN, redact it instead of relying on a password.