Protect PDF

The PDF specification defines a user password, which is required to open the document at all, and an owner password, which governs permissions such as printing, copying and editing. A file can carry either, both, or an owner password with an empty user password — the last combination is the familiar document that opens freely but refuses to let you print.

Only the user password provides real confidentiality, because it is what the encryption key is derived from. Permission flags are instructions that a well-behaved reader chooses to honour, which is why they can be cleared without ever knowing a password.

Encryption strength is rarely the weak link; the password is. Three or four unrelated words produce something long enough to resist brute force and short enough to read aloud over the phone, which matters when the recipient has to type it. Avoid the document name, the client name or the date, since those are the first things an attacker will try.

Send the password through a different channel from the file. A password in the same email as the attachment protects against nothing beyond accidental forwarding.

Covering sensitive text with a black rectangle leaves the characters underneath, fully selectable and fully searchable. The same applies to cropping, which only narrows the visible window onto content that is still present in the file. Both have caused well-documented public leaks.

To remove information for real, delete the affected content and flatten or rasterise the page so nothing survives underneath, then verify by selecting all text in the finished document and searching for the sensitive term.