PDF encryption is what makes password-protected and permission-restricted PDFs work. Understanding how it functions helps you make informed decisions about which level of protection is appropriate for your documents.

What Encryption Does in a PDF

When you add a password to a PDF, the content of the file (text, images, interactive elements) is encrypted using a cryptographic algorithm. Without the correct key (derived from the password), the content cannot be decoded — even if someone has the file.

This is different from a simple "lock" — an encrypted PDF's content is mathematically scrambled. Without the right password, it is just random data.

The Two Password Types

Open password (user password / document open password)

When a PDF has an open password, the content is encrypted. The password derives the decryption key. Without it, the viewer software cannot decrypt and display the content at all.

Strength: Depends entirely on the password itself and the encryption algorithm used.

Permissions password (owner password)

The permissions password controls a different set of restrictions: printing, copying, editing, and other operations. The document is encrypted, but the open password (if set) is different from the permissions password.

If a PDF has only a permissions password (no open password), it can be opened and read by anyone — but the restrictions are enforced by compliant viewer software.

Important: Permission-only restrictions rely on the viewer software to enforce them. The encryption technically still exists, but compliant viewers use a known algorithm to allow read access. Tools can bypass these restrictions in some cases.

Encryption Algorithms in PDFs

The PDF specification has evolved through several encryption standards:

| PDF Version | Algorithm | Key length | Status | |---|---|---|---| | PDF 1.1-1.3 | RC4 40-bit | 40 bits | Broken — do not use | | PDF 1.4-1.5 | RC4 128-bit | 128 bits | Weak by modern standards | | PDF 1.6-1.7 | AES-128 | 128 bits | Adequate for most uses | | PDF 2.0 | AES-256 | 256 bits | Current standard |

Modern PDF tools use AES-128 or AES-256. When you protect a PDF with ToolzStack's Protect PDF tool, AES encryption is applied.

What AES-256 Means in Practice

AES-256 (Advanced Encryption Standard, 256-bit key) is used to protect classified government communications in many countries. Against a strong, unique password:

  • The encryption itself is not the weak point
  • The weak point is almost always the password

A strong AES-256-encrypted PDF with a short or common password (like password, 1234, or companyname) can be broken quickly because password-based attacks test millions of common passwords per second.

A PDF with AES-256 and a 16-character random password containing uppercase, lowercase, numbers, and symbols is computationally infeasible to brute-force.

Choosing a Password: The Real Security Factor

The encryption standard only matters if the password is strong. Guidelines:

  • Minimum 12 characters; 16+ is better
  • Mix uppercase, lowercase, numbers, and symbols
  • Do not use words found in dictionaries
  • Do not use personal information (names, birthdays, company names)
  • Use a password manager to generate and store it

Certificate-Based Encryption

Beyond password encryption, PDF also supports certificate-based encryption — where access is granted using digital certificates rather than passwords. This is used in enterprise document management systems and government settings. It provides stronger identity verification but requires a certificate infrastructure.

What Encryption Does Not Protect Against

  • Screenshots and camera photos: Content visible on screen can be photographed
  • Retyping: Visible text can be manually transcribed
  • Metadata: File metadata (author, creation date, modification history) may not be encrypted and can reveal information about the document
  • Forgotten passwords: There is no recovery mechanism

Related guides: How to Password Protect a PDF · How to Protect a PDF from Editing