A Field Guide to PDF Passwords: What They Protect, and What They Don't
'I put a password on it' sounds like a single action, but a PDF can carry two passwords with completely different powers. Confusing them is one of the most common document-security mistakes, because one of the two provides real cryptographic protection and the other is closer to a polite request.
The user password (also called the open password) is the real lock. When set, the file's contents are encrypted — with modern AES-256 in current tools — and without the password the data is mathematically unreadable. No reader can show the pages, and no amount of clever file inspection recovers the text. The strength of this lock is the strength of your password: a long passphrase makes brute force impractical; 'invoice2024' does not.
The owner password (permissions password) is the polite request. The file opens freely, but flags tell readers to forbid printing, copying, or editing. Here is the uncomfortable truth: those restrictions are enforced by the goodwill of the reading software, not by encryption. The content must be decryptable for the file to display at all, so tools can — and routinely do — ignore the flags. Treat permission restrictions as a signal of intent, never as a security control: if someone must not read a section, redact it; if they must not open the file, use a user password.
Setting protection with PdfWill's protect tool applies real AES encryption, and the operation runs entirely in your browser — a detail that deserves a moment's thought. Encrypting a document through a typical online service means uploading the unencrypted original plus your chosen password to someone else's server; doing it locally means neither ever exists outside your device. The unlock tool is the honest mirror image: give it a file and the password you legitimately know, and it produces an unrestricted copy — useful for archiving your own documents without a decade of password prompts.
Three habits complete the picture. Send passwords over a different channel than the file — a text message, not the same email thread. Remember that encryption protects transport and storage, not what recipients do after opening: anyone who can view a page can photograph it, so pair passwords with redaction for truly sensitive fragments. And know the format's one unforgiving rule: a lost user password on a well-encrypted PDF is not recoverable by any legitimate tool — keep the original or keep the password.