PDF Passwords Explained: Open Passwords vs Permission Restrictions

You’ve probably seen it: a PDF opens fine, but Print is greyed out and you can’t copy a sentence. Another PDF won’t open at all until you type a password. Both are “password-protected PDFs”, but they work differently.

The two passwords

1. Open password (user password)

With an open password, the contents of the file are encrypted. Without the password, a PDF reader sees only scrambled data. It can’t show the pages, extract text or render images.

• Used for: bank statements, payslips, medical reports, HR documents
• Strength: with modern AES-256 encryption and a strong password, it’s very secure

2. Permissions password (owner password)

With a permissions password, the file opens for everyone. It carries flags asking the reader app to block certain actions:

• Printing (or high-quality printing)
• Copying text and images
• Editing, commenting or filling forms
• Extracting pages

The catch is that these are instructions to the PDF reader, not hard locks. A well-behaved reader honours them, but they can be removed easily, which is what Unlock PDF does for files you own. Treat permissions as a polite “please don’t”, not real security.

A file can have both

A document can use an open password and a permissions password. Someone with only the open password can read it but faces the restrictions. Someone with the owner password can do everything.

How strong is PDF encryption?

It depends on the encryption method and on the password:

Encryption	Status
RC4 40-bit	Obsolete: can be broken quickly
RC4 128-bit	Weak by today’s standards
AES-128	Good
AES-256	Strong: current best practice

Strong encryption only helps if the password is strong too. A password like name1990 can be guessed by software that tries common patterns. Statements protected with your date of birth keep out casual snoopers, not determined attackers.

Best practices when you protect a PDF

• Use AES-256 if your software lets you choose.
• Choose a long password. Four random words beat eight characters with symbols.
• Send the password separately. If the file goes by email, share the password by phone or SMS, not in the same email.
• Don’t rely on permissions alone for anything genuinely confidential. Use an open password.

Best practices when you receive one

• If you’ll open it often and the device is secure, keep an unlocked copy in an encrypted location.
• Delete old statements you no longer need. The safest file is the one you don’t have.

Quick recap

• Open password: real encryption that keeps people out.
• Permissions password: restrictions that ask readers to behave and are easily removed.
• Security comes from AES-256 plus a strong password, shared through a separate channel.