Make a PDF Secure: What Actually Protects It

Making a PDF secure means choosing the right combination of three distinct protections: encryption with a user password (the file cannot be opened without it), permission flags (a request that viewers block printing or copying — enforced only by the viewer's good manners, not by cryptography), and content removal such as redaction and metadata stripping (nothing sensitive remains in the file at all). Only the first and third genuinely protect anything. This page explains each level, the AES encryption behind it, and gives free, verifiable recipes.

Published July 24, 2026 · Last updated August 5, 2026

Why there is no one-click converter on this page

Writing a standards-correct encrypted PDF means implementing the PDF security handler — key derivation, AES-CBC encryption of every stream and string, and permission records — and getting one detail wrong produces a file that either will not open or only pretends to be protected. Audited desktop tools do this properly, so the recipes below use them.

Disclosure: this page contains affiliate placeholder links. If they were live, we could earn a commission at no extra cost to you.

AFFILIATE PLACEHOLDER: Recommended desktop PDF suite (placeholder link)

How to make a PDF secure (step by step)

Method 1: AES-256 encryption with qpdf (free, command line)

Choose a strong passphrase. Pick a passphrase of at least four random words or 16 mixed characters. The encryption is only as strong as the password, because attackers try password guesses rather than breaking AES itself.
Encrypt the file with qpdf. Install the free qpdf tool and run: qpdf --encrypt USERPW OWNERPW 256 -- input.pdf secured.pdf. This writes a copy encrypted with AES-256; the original is untouched.
Verify the protection. Open secured.pdf and confirm it demands the password before showing any content. Check the security properties in your viewer to confirm 256-bit AES is listed.
Share the password separately. Send the password over a different channel than the file — a phone call or messaging app, never the same email as the attachment.

Method 2: LibreOffice or Adobe Acrobat (graphical)

LibreOffice can encrypt any PDF it exports: File → Export as PDF → Security tab → Set passwords, where the "open" password is the user password and the "permission" password is the owner password with checkboxes for printing and copying. Acrobat Pro's Protect Using Password does the same with AES-256. Either way, verify afterwards by opening the result and checking that a password prompt appears before any content.

Method 3: Remove what should not be shared at all

Encryption controls who opens the file; it does nothing about what the file contains once opened. Before sending, permanently remove sensitive passages with our Redact PDF tool (it flattens redacted pages so the underlying text is truly gone) and strip author names, tool traces, and hidden document properties with Remove PDF metadata. For the fundamentals of password protection itself, see the companion Protect PDF guide.

How it works

PDF encryption operates inside the file structure, not around it. The document's cross-reference skeleton and object numbers stay readable — that is how a viewer can render the password prompt — while every stream (page content, images, fonts) and every string is encrypted. An /Encrypt dictionary in the trailer records the algorithm and two password verification values. When you type the password, the viewer derives the file key from it (modern revision 6 files use repeated SHA-256 hashing) and checks it against those stored values; only then can it decrypt the content streams with AES in CBC mode. Because the check material is in the file, anyone can run password guesses offline at high speed — which is why the passphrase, not the cipher, is the real security boundary. Legacy 40-bit RC4 encryption from the 1990s, still produced by some old software, can be stripped in seconds and should never be used; AES-128 (PDF 1.6) is acceptable and AES-256 (PDF 2.0, standardized in ISO 32000-2) is the current recommendation.

Permission flags live in that same /Encrypt dictionary as a 32-bit integer: bit 3 allows printing, bit 5 copying, and so on. Here is the part most people miss: when a file has only an owner password, the specification requires viewers to decrypt it with no password at all and merely asks them to honor the flags. The content is cryptographically available to every reader; obedience is voluntary. Adobe Reader obeys; plenty of libraries and tools do not. That is why "no-copy, no-print" PDFs circulate freely as unrestricted copies, and why this page keeps repeating that permissions are viewer-enforced etiquette, not protection.

The third layer is subtraction. A black rectangle drawn over text hides nothing — the text objects remain beneath it. True redaction deletes those objects and flattens the region; metadata stripping empties the Info dictionary and XMP packet. What is not in the file needs no protecting.

Worked example: securing a 9-page severance agreement

An HR manager needed to send a 9-page, 240 KB severance agreement to one recipient. Step one: redaction of two other employees' salaries mentioned on page 4 — the redact tool flattened that page to an image, growing the file to 610 KB. Step two: metadata stripping removed the author field (a previous employee's name) and 3 KB of editing history. Step three: qpdf --encrypt "coral-anvil-tundra-nine" "Hx7#..." 256 -- draft.pdf final.pdf ran in 0.3 seconds; the encrypted file was 612 KB and demanded the password on open in three different viewers. As a control, we also produced an owner-password-only copy with printing disallowed: a common open-source PDF library opened it without any password and printed it on the first try — a concrete demonstration that permission flags alone protected nothing.

Frequently asked questions

Does a PDF permission password stop people from copying or printing?

Not reliably — permission flags are instructions that compliant viewers choose to obey, while the file's content stays readable. Any tool that ignores the flags, and many do, can copy, print, or strip them, so treat permissions as etiquette, not security.

What is the difference between a user password and an owner password?

A user password encrypts the document so it cannot be opened at all without it. An owner password only signs off on the permission flags for printing, copying, and editing — a file with just an owner password opens for anyone and its restrictions can be removed.

Is AES-256 PDF encryption actually strong?

The cipher is effectively unbreakable, so attackers guess passwords instead. A short or common password falls to cracking tools in minutes regardless of AES-256, while a random four-word passphrase pushes cracking beyond practical reach.

Does password-protecting a PDF hide text I covered with black boxes?

No — a drawn black rectangle leaves the text underneath fully present and selectable once the file is opened. Only true redaction, which deletes the text and flattens the page, actually removes it; encryption just controls who can open the file.

Should I still remove metadata from an encrypted PDF?

Yes — author names, tool versions, and revision traces travel with the file and are exposed to anyone you give the password to. Strip metadata before encrypting if the recipient should only see the page content.

Can I make a PDF secure without any password?

Partly — you can redact sensitive content, strip metadata, and flatten forms so the visible file carries nothing hidden, then rely on the sharing channel for access control. What you cannot get without a password is protection of the file itself once it leaves you.