PDF encryption: what it is and what it is for

In 30 seconds

Encrypting a PDF turns its content into unreadable data without the right password.
The open password protects the content; the permissions password is only a hint that some programs ignore.
A short or easy-to-guess password gives little security, and if you forget it there is no simple way to recover it.
Encrypting is not the same as signing, flattening or redacting.

1What is PDF encryption and what does it protect?

Encrypting a PDF means transforming its content with a key derived from a password, so that without that password the file is unreadable even if someone gets hold of it. It is the way to protect a document's confidentiality when it travels by email, messaging or a shared cloud, or when it is stored on a device that could be lost.

What it protects is the content against anyone who does not have the password. It does not protect against someone who does, it does not guarantee the document is authentic, and it does not stop the recipient from forwarding it once opened. It is an access barrier, not a control over what happens afterward.

2How does encryption work under the hood?

When you set a password, the program turns it into a cryptographic key and uses it to encrypt the text, images and other data in the file. When you open it, the viewer asks for the password, derives the key again and decrypts the content on the fly to display it. The password is not stored in the file as readable text.

PDFs have used different algorithms over the years. The oldest use RC4, now considered weak, and modern ones use AES, with 128-bit or 256-bit keys. The final strength, however, depends far more on the password than on the algorithm: a four-digit password can be fully tried in an instant with the right program.

3What is the difference between an open password and a permissions password?

A PDF can carry two passwords. The open password, also called the user password, is required to view the document and is the one that actually protects its content. The permissions password, or owner password, specifies which actions are allowed, such as printing, copying text, editing or annotating.

The important nuance is that permission restrictions are enforced by the program that opens the file, and not all programs respect them. A document that opens without a password but has printing disabled is still readable, and some tools ignore those flags. So if what you need is confidentiality, you need an open password.

4When should you encrypt a PDF, and when not?

Encrypt documents containing personal, financial, medical or employment data that you will send or store outside a controlled location. A good practice is to share the password through a different channel than the file: the document by email and the password by messaging or phone call.

Do not encrypt files meant to be kept for a very long time, because a lost password would leave them inaccessible, which is why PDF/A does not allow encryption. It also makes no sense for public documents. And encryption does not replace other measures: if the content includes data that should not leave, the right move is to remove it beforehand.

5Common mistakes and myths about encryption

The most frequent mistake is trusting the permissions password as if it were real protection. Another is mixing up concepts: encrypting is not signing, because a signature guarantees who signed and that nothing changed, while encryption only restricts access; it is not flattening either, which locks the content in place but leaves the file open; and it is not redacting, which removes information from the document.

People also believe any password is enough. Short passwords, or ones with names, birth dates or sequences, are the first ones tried. And it is a myth that removing a password is always hacking: if you know the password, removing it from your own file is a legitimate and routine operation.

6Common problems and how to fix them

The most serious problem is forgetting the password. With modern encryption and a long password, there is no simple way to recover it, so store the password in a password manager and keep an unencrypted copy of the original in a safe place. Another problem is the recipient not being able to open the file: check that you typed the password correctly, especially with accents, special characters or symbols, and try a different viewer.

If the recipient cannot print or copy, a permissions restriction was probably applied. To remove it, you need the password and must save the file again without restrictions.

7Encryption and working in Rayo PDF GO

Protect PDF adds a password to your document and Unlock PDF removes it, and both operations run on your device: neither the file nor the password travels to a server. Unlock PDF only works if you know the password; Rayo PDF GO does not try to guess or crack unknown passwords.

A recommended order is to leave encryption as the last step: first merge, organize, sign or compress the document, and protect it at the end. If you need to hide specific information before sharing, use Redact PDF to truly remove it, and do not rely on the password as your only safeguard.

Related tools

Frequently asked questions

Can I remove the password from a PDF?

Only if you know the password. Rayo PDF GO does not try to crack unknown passwords.

What happens if I forget my PDF password?

With modern encryption and a long password, there is no simple way to recover it. Store passwords in a manager and keep a copy of the original.

Is the permissions password secure?

Not as confidentiality protection. Printing, copying or editing restrictions depend on the program respecting them, and some ignore them.

Is encrypting a PDF the same as signing it?

No. Encrypting restricts who can read the document. Signing identifies the signer and detects later changes.

What algorithm is used to encrypt a PDF?

It depends on the format version. Modern ones use AES with 128-bit or 256-bit keys, while the old RC4 is considered weak.

Can I encrypt a PDF/A?

No. The PDF/A standard prohibits encryption to make sure the document can be opened in the future.

Keep learning

See the whole knowledge base ›