PDF Passwords, Permissions and Encryption

Two different passwords

	Open password (user password)	Permissions password (owner password)
What it does	Must be entered to view the file	Restricts printing, copying, editing, form filling
Is the content encrypted?	Yes, unreadable without the password	Content is encrypted but readable by anyone
How strong?	Strong with AES-256 and a good password	Weak, easily bypassed by many tools
Typical use	Bank statements, payslips, confidential reports	Discouraging edits to published documents

A PDF can have one, both, or neither.

Encryption strengths

Method	PDF version	Strength
RC4 40-bit	1.1+	Broken, crackable in minutes
RC4 128-bit	1.4+	Outdated
AES 128-bit	1.6+	Good
AES 256-bit	1.7 ext. / 2.0	Recommended

The encryption is only as strong as the password. A 6-digit number (like a birth date, often used by banks) can be guessed quickly by software. Use 12+ random characters for truly sensitive files.

Common real-world patterns

• Banks and payroll often use your date of birth, account number digits or ID number as the open password. The email usually explains the format.
• Published reports may carry “no copy / no print” permissions.

Good practice

• Send the password through a different channel than the file (e.g. text message vs email).
• Prefer AES-256 when your tool offers a choice.
• For long-term archives, avoid encryption: PDF/A forbids it, and lost passwords mean lost documents.

Next: How to password-protect a PDF · How to remove a PDF password