Applies to: Authorized PDF protection. This guide does not describe bypassing someone else’s document restrictions.
An open password encrypts the PDF so a reader needs the password to view it. A permissions password controls allowed actions such as editing, copying, or printing. Keep an unprotected backup and share passwords through a separate secure channel.
The two controls solve different problems
A document-open password limits who can open the file. A permissions password can restrict changes, printing, or copying after the file is open. Software may present both options in one security dialog.
A file that opens without a password can still carry permission restrictions. Conversely, a file protected by an open password may allow full use after the correct password is entered.
Choose the control based on the risk
- Use an open password when access to the document itself must be limited.
- Use permissions only when you need to communicate intended editing or printing controls.
- Use a strong, unique password that is not included in the same email as the PDF.
- Keep an unprotected master in an appropriately secured location.
- Test the protected copy in a second PDF reader before sending it.
Know the limits of permissions
Permission controls depend on reader software honoring them. They should not be treated as a complete digital-rights or data-loss-prevention system.
For sensitive workflows, use an approved secure sharing platform with identity, access expiration, audit, and revocation controls rather than relying only on a PDF permissions password.
Do not lose the only password
A forgotten document-open password can make the file inaccessible. Store recovery information according to your organization’s password and records policy.
Never test security on the only copy. Protect a duplicate, reopen it, and confirm the intended printing and editing behavior.
Verify both the unopened and opened experience
Create a disposable test copy. Close it, reopen it, and confirm whether the intended password is actually requested. Once open, check the intended print, copy and edit behavior in the recipient’s approved reader. Do not assume that a password entry field in the editor means the output was encrypted.
Send the password through a different trusted channel from the file. If access needs to expire or be revoked, a password-protected attachment alone cannot reliably retrieve copies already downloaded; use an approved sharing service that supports those controls.
Sources and further reading
Vendor instructions and background references are linked below. Worked examples are our explanatory calculations, not vendor performance claims. Check the instructions for your current software and device.
Report a correction with this page’s title and the step or result that needs attention.