What PDF password protection actually protects

The two passwords have completely different jobs

A user password, often called the open password, is required before the pages can be decrypted. Without it the document does not open in a compliant reader, and the file's strings and streams stay encrypted. That is the strong lock: no password, no content.

An owner password, sometimes called the permissions password, grants full access to the document. A reader that receives the owner password opens the file without restrictions and can change or remove the security settings. The user password opens the same file under the permission flags the owner chose. A file can also have an empty user password and a non-empty owner password, which is why some protected PDFs open without asking for anything while still carrying restrictions.

What the cipher protects, and what it leaves readable

Under the standard security handler, PDF strings and streams are encrypted, which covers page content, embedded fonts and most images. The document structure stays readable enough for a viewer to find objects, and some metadata can remain outside encryption depending on the creator's settings. Encryption protects the file's contents, not the fact that the file exists or who sent it.

The cipher matters too. RC4 and 128-bit AES belong to an earlier generation of PDF security; RC4 is a legacy stream cipher with known weaknesses, and modern PDF specifications deprecate it. AES-256 is what PDF 2.0 specifies and the reasonable option for new documents: PDF 1.7 files carry it through an extension declaration, and current readers handle that transparently.

Permission bits: what they add up to

The permission flags describe what a cooperative reader should allow: printing, optionally only at low resolution; modifying page content; copying text and images; adding annotations; filling form fields; extracting content for accessibility; and assembling pages. The owner password sets them, the file records them, and the reader enforces them.

That last step is the weak link. Permissions are a request to the viewing application, not a cryptographic barrier. Many mainstream readers honor the flags, but a viewer that ignores them, a screenshot, or a retyped page gets around the restriction once the file is open. Use permissions to discourage casual edits and reproduction, never as a substitute for controlling who receives the file.

• Treat permissions as a label, not a lock: they signal what the sender intended.
• Assume a determined recipient can photograph the screen or retype a paragraph.
• Use real access control, such as encrypted storage or recipient accounts, for genuinely confidential material.
• Record the owner password with the document so permissions can be revised later.

Why a lost password usually cannot be recovered

The encryption key is derived from the password and the document's security data; there is no recovery field and no backdoor in the format. For AES-256 with a long password, trying keys at scale is not a realistic route, which is the point of the design. Old RC4 files with short passwords are another matter: the weak cipher and small search space mean cracking tools can sometimes succeed, which is one more reason to avoid reproducing legacy protection.

If you still know the owner password, you can open the file with full access and save a fresh copy; that is not recovery, just access you already had. If both passwords are gone, no reputable service can promise to restore the document, so keep the password in a password manager and an unprotected master in controlled storage.

What unlock tools really do

An unlock tool takes the password you provide, decrypts the file with it, and writes a new PDF that is not encrypted. There is no legitimate shortcut around the password: the tool needs the key, and the key comes from the correct password.

The output approach varies. Some tools preserve the original page objects, keeping text selectable and the file size close to the source. Others rasterize each page and rebuild the PDF from images, which works for any layout but turns text into pixels, loses links and form fields, and often inflates the file. Our Unlock PDF tool uses the rasterizing approach, so treat its output as a viewable copy rather than a text archive. Either way, work only on documents you own or are authorized to unlock, and expect a digital signature to break when the bytes change.

A safe workflow for protecting copies

Start with an unprotected master file in storage you control, and protect copies for distribution. That way a forgotten password costs a re-export rather than the document. Choose a long, unique password, record it in a password manager at the moment you set it, and send it through a different channel from the PDF so one intercepted message does not reveal both.

Good candidates for this workflow are signed contracts, payslips and salary letters, and scans of identity documents, all of which are commonly emailed as unprotected attachments. Check the protected copy once before deleting the working version: open it, enter the user password, confirm the pages render, and try the actions the permissions are meant to allow or block. If you later need to add a watermark or page numbers, make those changes on the master and protect the result again rather than editing the distributed copy.