Password protect a PDF: open password, permissions, and what each one stops

You need to send a contract, a payslip or a medical report, and email is the only channel the other side uses. The sensible move is to password protect a PDF before it leaves your machine, so the file is unreadable to anyone who intercepts the message or finds it in a shared inbox later. Which of the two PDF passwords you set decides whether that is true.

Two passwords, two different jobs

A PDF can carry an open password and a permissions password, and they are not interchangeable.

The open password, sometimes called the user password, encrypts the file. Without it the reader shows a password prompt and nothing else. This is the one that protects a document in transit or at rest.

The permissions password, also called the owner password, does not stop anyone from opening the file. It locks a set of flags: printing, copying text, editing, filling forms, adding comments. Readers that follow the PDF standard respect those flags, but the file itself is readable once open, so enforcement is up to the viewer. Adobe says as much in its own help, and Firefox's built-in viewer ignores copy restrictions unless a hidden preference is switched on. Permissions are a request to well-behaved software.

Set both when you can, and make them different. In Acrobat, when both are set, either password opens the file; only the permissions password can change the restrictions, so if the two are the same, anyone who can open the file can also lift them.

One compatibility note. 256-bit AES, the level our tool and current Acrobat use, needs Acrobat or Reader X (version 10) or later on the recipient's side. Older software shows an error instead of a password prompt.

Password protect a PDF online

The quickest way when the file is already on your computer is the Protect PDF tool. It runs in the browser, needs no install, and encrypts with 256-bit AES.

1. Open Protect PDF and drop the file on the upload box, or click to browse for it.
2. Type the open password. This one is required and is what the recipient will enter to read the document.
3. Optionally add a permissions password. It blocks printing and editing in readers that honour the flags.
4. Run it and download the protected copy. Open it once yourself to confirm the prompt appears before you send it.

Transfers use HTTPS and free-tier files are deleted automatically after the job finishes, so download the result straight away. The same options work through the conversion API, which is the route for a folder of invoices rather than one file.

What happened when we tried it

On 10 October 2026 we protected a nine-page, 184 KB PDF with an open password and a different permissions password, then opened the result with a PDF library instead of a viewer, so the file could not hide anything behind a dialog.

The last row is worth a second look. The first time we ran this test the file carried the permissions password but no restriction flags, so printing stayed allowed; we fixed the tool the same day, and the table shows the result after the fix. Copying and form filling are deliberately left open, because the label promises only editing and printing. Remember that these two flags bind readers that honour them; the open password is still the protection that matters.

On a Mac: Preview

Preview can do this without any extra software. Open the PDF, choose File, then Export, and give the copy a new name if you want to keep an unencrypted original. Click the Permissions button. Tick Require Password To Open Document and enter the password twice. Below that, each checkbox is an action readers may perform without the owner password; leave one unticked to require it. Set the owner password, click Apply, then Save. To change the settings later, use File, then Edit Permissions; to remove the password, export the file again with encryption turned off.

From Word on Windows

If the document starts life in Word, you can protect the PDF as you create it. Choose File, then Save As, set the type to PDF, click Options and tick "Encrypt the document with a password". Enter it twice, confirm, and save. The same checkbox sits under File, Export, Create PDF/XPS Document, Options. If the checkbox is greyed out, untick "PDF/A compliant" in the same dialog first; readers on Microsoft Q&A hit exactly that. Two limits worth knowing: Word sets an open password only, with no permissions password, and Microsoft's page does not say which encryption level it uses. Word also keeps showing the unencrypted .docx afterwards, so delete it or protect it separately if the source is also sensitive.

If the recipient cannot open it

Two complaints come up again and again in the Adobe and Apple forums. Phone and tablet readers sometimes ask for the owner password before they will let the reader fill in a form, even though the open password was accepted; Adobe calls that designed behaviour. And some corporate mail systems quarantine encrypted attachments because the scanner cannot read them, so tell a company recipient what to expect and keep a second channel, such as an expiring share link, ready.

Choosing a password you will still have next year

• Length beats cleverness. A short phrase of unrelated words is easier to type into a reader prompt than a string of symbols, and harder to guess.
• Never reuse the file name, the recipient's name or a date that appears in the document.
• Send the password over a different channel than the file: the PDF by email, the password by message or phone.
• Save it in a password manager at the moment you set it. A forgotten open password cannot be reset, and the usual advice to keep an unprotected original only helps if you still have one.

What a password does not do

Encryption hides the document from people who do not have the password. It does nothing about the people who do. A recipient with the open password can forward the file, screenshot it or print it to a new unprotected PDF. Three situations call for a different tool:

• Text that must never be visible to the recipient at all is a redaction job. Redact PDF removes it from the file instead of hiding it behind a prompt.
• A document that has to prove who approved it needs a signature. Sign PDF adds one.
• A file you want people to read but not pass around is a sharing problem: an expiring link does more than a permissions flag. A PDF cannot expire on its own; Acrobat's own forum says so.

Removing the password later

When a protected file comes back to you and you want a clean copy, Unlock PDF removes the protection as long as you know the current password. Preview does the same through Export with encryption turned off.

Sources

• Apple, Preview User Guide, "Password-protect a PDF on Mac": https://support.apple.com/guide/preview/prvw587dd90f/mac
• Microsoft, "Save or convert to PDF or XPS in Office Desktop apps": https://support.microsoft.com/en-us/office/save-or-convert-to-pdf-or-xps-in-office-desktop-apps-d85416c5-7d77-4fd6-a216-6f4bf7c7c110
• Adobe, "Document security algorithms" (Acrobat compatibility levels and 256-bit AES from Acrobat X), 2013: https://www.adobe.com/devnet-docs/acrobatetk/tools/QuickKeys/Acrobat_DocumentSecurityAlgoAll.pdf
• PDF Association, ISO 32000-2:2020 clause 7 errata (revision 6 uses AES-256; revisions 1 to 5 deprecated), June 2026: https://pdf-issues.pdfa.org/32000-2-2020/clause07.html
• Mozilla pdf.js, pull request adding the opt-in enablePermissions preference (copy restrictions ignored by default), April 2020: https://github.com/mozilla/pdf.js/pull/11789
• Microsoft Q&A, "How to password protect a PDF and a Word document", November 2020: https://learn.microsoft.com/en-us/answers/questions/5078162/how-to-password-protect-a-pdf-and-a-word-document
• Microsoft Q&A, the greyed-out "Encrypt document with a password" option, November 2019: https://learn.microsoft.com/en-us/answers/questions/5006384/why-is-the-pdf-option-save-as-pdf-encrypt-document
• Adobe Community, "How can I remove a forgotten password from a PDF file?", May 2025: https://community.adobe.com/t5/acrobat-discussions/how-can-i-remove-a-forgotten-password-from-a-pdf-file/td-p/15306586
• Adobe Community, PDFs asking for the owner password on iPhone and iPad, January 2023: https://community.adobe.com/t5/acrobat-reader-mobile-discussions/pdfs-suddenly-asking-for-owners-permission-only-on-ipad-and-iphone-app-but-not-on-mac/td-p/13510760
• Microsoft Q&A, an encrypted PDF quarantined by the recipient's mail system, July 2021: https://learn.microsoft.com/en-us/answers/questions/088975e7-6887-4b56-85b8-7abde4294c12/sending-a-password-protected-pdf-to-an-office-365?forum=outlook_com-all
• Adobe Community, "How can I set an expiry date on a PDF file?", February 2022: https://community.adobe.com/t5/acrobat-reader-discussions/how-can-i-set-an-expiry-date-on-a-pdf-file/td-p/12740571
• Our own test run on the indox Protect PDF tool, 10 October 2026, table above.