SuperFastFiles
Guides · October 8, 2026

How to Password Protect a PDF, and What the Two Password Types Mean

A PDF can carry two different passwords, and they do very different jobs. One encrypts the document so that nobody can read it without the password. The other only asks the reading software to stop people from printing, copying or editing, and leaves the document open to anyone. Many people set the second kind believing they have set the first. This guide explains the difference, what makes a PDF password strong, and how to protect a file without locking yourself out of your own work.

The Open Password

The open password, called the "user password" in the PDF specification and the "document open password" in Adobe Acrobat, is the one that does the real protecting. When it is set, the contents of the file are encrypted. Without the password, a PDF reader has nothing to display but scrambled bytes. It cannot show a preview, and a search tool cannot index the text.

How well this protects you depends on two things: the encryption method used and the password you choose. Both are covered below.

The Permissions Password

The permissions password, called the "owner password" in the specification, controls what people may do with a document they can already open. It can restrict printing, editing, copying text and images, adding comments, filling in forms and extracting pages.

Here is the catch. If a PDF has a permissions password but no open password, it opens without asking for anything. The file is technically encrypted, but with a key that any reader can work out, because every reader has to be able to display it. The restrictions are then a set of flags that the reading software is asked to respect. Adobe's software and most mainstream readers do respect them. Software that chooses not to can ignore them entirely.

So a permissions password is useful for discouraging casual changes, such as stopping a form from being edited by accident or keeping a draft from being printed. It does not keep anyone from reading the document, and it should not be relied on to stop a determined person from copying it.

The two passwords can be set together. In that case, the open password lets people read the document within its restrictions, and the permissions password both opens it and lifts them.

The Encryption Behind the Password

PDF encryption has changed a lot since the format appeared. Very old files use RC4 with a 40-bit key, which is weak enough to be broken by trying every possible key, however good the password was. Later versions moved to 128-bit RC4, then AES-128, and current versions of the PDF standard use AES-256, which is what you want.

You can check which method a file uses in your PDF reader's document properties. In Adobe Acrobat Reader, it is under File, Properties, Security. If an important document shows an old method, protect it again with a current tool.

How Strong the Password Needs to Be

A PDF password is attacked differently from a website password. When someone has a copy of the file, they can try passwords against it on their own computer, as fast as their hardware allows. There is no lockout after three wrong attempts and nobody is alerted. Strong encryption does not help if the password is easy to guess.

  • Length matters most. A passphrase of four or five unrelated words is far harder to guess than a short password full of symbols.
  • Avoid anything personal. Birthdays, names and postcodes are the first things an attacker tries. Statements protected with your date of birth are protected only from people who do not know it.
  • Do not reuse a password. Never use the password of your email or bank account to protect a PDF you send to someone else.

How you share the password matters as much as the password itself. Do not send it in the same email as the file: if that email is forwarded or intercepted, the file and its key travel together. Send the password another way, by text message or in a phone call.

Protecting a PDF With SuperFastFiles

Our Password Protect PDF tool sets an open password and encrypts the PDF with AES-256: anyone who opens it is asked for the password. You add the file, type the password and download the protected copy.

The file and the password are sent to a document conversion provider, which states that it deletes the file and the result within three hours. The password is used only to encrypt that file. We do not keep it, and we cannot recover it, reset it or open the file for you. If you lose the password, you may lose access to the contents for good, so store it somewhere safe, such as a password manager.

A PDF that already has a password cannot be protected again directly. The tool tells you to unlock it first, using the password you know, and then protect it with the new one.

Make Protection the Last Step

Once a PDF has an open password, most tools cannot read it, ours included. PDF Merger, Sign PDF, PDF to Word, PDF to Excel and Compress PDF all need to open the file, and they will tell you it is protected. So finish the document before you protect it:

  • merge the files, reorder the pages and remove the ones you do not need;
  • sign it, and compress it if it is too large to send;
  • then add the password, and send the protected copy.

Keep an unprotected original somewhere private, so that you can make changes later without needing the password.

What a Password Does Not Do

A password controls who can open a file. It does nothing about what happens afterwards. Anyone who has the password can share it, or save an unprotected copy, for example by printing the document to a new PDF. A password does not expire, and it does not record who opened the file or when.

Encryption also covers the document's contents, not everything about it. The file name is never encrypted, and some tools leave the document's descriptive information, such as its title and author, readable. Do not put anything sensitive in a file name.

Finally, a password protects the whole document, all or nothing. If the aim is to share a document while keeping parts of it secret, a password is the wrong tool: you need to redact those parts, so that they are removed from the file altogether.

Conclusion

Of the two PDF passwords, only the open password keeps people from reading a document. The permissions password is a request that well-behaved software honors. Use an open password with current encryption, choose a long passphrase, send it separately from the file, and add it as the very last step, once the document is finished.

Ready to lock a document? Try Password Protect PDF.

← Back to the blog