PDF Passwords Explained: Open Password vs. Permissions

Putting a password on a PDF feels like locking it in a safe. Sometimes that is exactly what happens. Other times the “lock” is closer to a polite sign on an unlocked door. The difference comes down to which of the two PDF passwords you use, which encryption method protects the file, and how good the password itself is.

Two passwords, two very different jobs

The PDF format defines two separate passwords that are easy to confuse because readers ask for both in similar-looking dialogs.

The open password (user password)

This is the password you type to see the document at all. When it is set, the contents of the file, its text, images and fonts, are encrypted with a key derived from that password. Without it, the bytes on disk are meaningless. This is real protection: nobody can read the pages without either knowing the password or guessing it.

The permissions password (owner password)

The second password controls what someone may do once the document is open: print it, copy text, change pages, add comments or fill in forms. A file can have permissions without an open password, in which case it opens for everyone, and the reader is simply told which actions to allow.

What restrictions do and don’t protect

Here is the part many people find surprising. If a PDF opens without a password, the reader must be able to decrypt it on its own, which means the key is effectively available to any software that opens the file. Respecting the “no printing” or “no copying” flags is then a matter of the program choosing to obey them. Mainstream readers do; plenty of other tools do not.

So restrictions are useful for signaling intent and stopping casual actions, like an employee accidentally editing an approved form. They are not a way to keep content secret or to prevent a determined person from copying it. Remember too that anything that can be displayed can be photographed or screenshotted.

AES-256 versus older RC4 encryption

PDF encryption has evolved through several versions. Early files used RC4 with a 40-bit key, which can be brute-forced quickly on ordinary hardware. Later versions moved to 128-bit RC4 and then to AES with 128-bit keys. The current standard method uses AES with 256-bit keys together with a stronger way of turning the password into a key.

RC4 is considered broken as a cipher, and the older password-handling schemes make guessing attacks cheaper. If you are protecting something sensitive, AES-256 is the method to use. Very old PDF readers may not support it, but any reasonably current reader on desktop or mobile does.

One important point: strong encryption does not save a weak password. AES-256 makes it pointless to attack the encryption itself, so attackers try passwords instead. A short dictionary word falls in seconds no matter how good the cipher is.

Choosing a password that actually protects

• Length matters most. A passphrase of four or five unrelated words, or a random string of 12 or more characters, is far harder to guess than a short complex-looking one.
• Avoid the obvious. Names, birthdays, company names, “123456” and keyboard patterns are the first things any guessing tool tries.
• Don’t reuse. A password used elsewhere may already be in a leaked list.
• Send it separately. If you email the PDF, share the password by another channel, such as a phone call or a message app, not in the same email.
• Stick to ordinary characters if the file must open everywhere. Emoji and some special symbols are handled inconsistently by certain PDF readers.

Protecting a PDF with vupdf

The vupdf Protect PDF tool encrypts files with AES-256. You set an opening password of at least four characters, and a strength meter gives concrete tips as you type, such as making it longer or adding digits and symbols. There is also a button to generate a strong random password and copy it.

By default the one password both opens the file and grants full rights. If you open the permissions section, you can choose what is allowed after opening: printing (none, low quality or high quality), copying text and images, adding and editing pages, and commenting and filling in forms. You can add a separate owner password to change those permissions later; if you leave it empty, the permissions are locked for good and nobody can change them. A file that is already protected has to be unlocked first before a new password can be set.

Removing a password, and what to do if you forget it

If you know the password and want to get rid of it, for example to archive a file or to send it into a system that cannot handle encrypted PDFs, the vupdf Unlock PDF tool removes it. You type the password, and the file is written out again without encryption, keeping bookmarks, document properties, links and form fields. For files that open without a password but carry restrictions, the tool removes the restrictions, which illustrates the point made earlier about how little they protect.

The tool does not crack passwords. You need to know the one that opens the file. If you have genuinely forgotten it, these are the realistic options:

1. Look for an unprotected copy: the original source document, an earlier email attachment, a backup or a shared folder.
2. Ask the person or organization that sent the file to send it again or tell you the password.
3. Try the passwords you commonly use, paying attention to capital letters and to whether your keyboard layout changed the characters you typed.
4. Accept that a well-protected file may be lost. That is the encryption doing its job.

Only try to open documents you are entitled to access. Getting around protection on someone else’s file can be unlawful even when it is technically possible.

The short version

Use an open password when content must stay private, and make it long and unique. Treat permission restrictions as a helpful signal, not a security measure. Prefer AES-256 over older methods, share passwords through a separate channel, and keep a safe record of them, because a properly encrypted PDF with a forgotten password stays locked.