Blog

How PDF passwords work, and why there are two of them

A PDF can carry two passwords that do very different jobs. One encrypts the file. The other only asks your viewer to behave. How to tell which you have.

By Harish27 September 20266 min read

A PDF can have two passwords, and they do completely different jobs. The open password encrypts the document, so nothing can show you a page without it. The permissions password does not lock anything you can see. It sets a few flags asking your viewer not to print, copy or edit, and the viewer decides whether to listen.

Almost every confusing thing about locked PDFs comes from mixing those two up. A file that opens fine but will not print is not “partly locked”. It has the second kind. A file that asks for a password before it shows you anything has the first. They need different fixes, and only one of them needs a password at all.

The two passwords, side by side

The PDF specification calls them the user password and the owner password. Adobe Acrobat calls them the “document open password” and the “permissions password”, which are better names, so this post uses those.

	Open password	Permissions password
Specification name	User password	Owner password
What you see	A prompt before any page appears	The file opens, then print or copy is greyed out
What it protects	The content itself	A list of allowed actions
Who enforces it	Mathematics	Your PDF viewer, voluntarily
Can you remove it without the password?	No	Yes

A file can have either one, both, or neither. Bank statements usually have only an open password. Published reports and course materials usually have only a permissions password. Contracts sent for review sometimes have both.

What actually happens when a PDF is locked

A locked PDF is not a normal PDF with a password stored next to it. There is no password in the file at all, which is the first thing most people get wrong.

Here is what happens instead. The software that locks the file turns the password into an encryption key, then uses that key to scramble every piece of text and every image stream inside the document. It also writes a small check value into the file, computed from the password, so that a viewer can later tell whether the password you typed is the right one without the file ever containing it.

When you open the file and type the password, your viewer repeats the same calculation. If the result matches the check value, it has the key, and it unscrambles the pages as it draws them. If not, you get the prompt again.

That is why “I forgot the password, can you read it out of the file?” has no good answer. The file does not contain it. It contains enough to tell a right guess from a wrong one, and nothing more. There is a whole post on what that means if you have forgotten a PDF password.

Why the permissions password is not really a lock

This is the part that surprises people, so it is worth being precise.

A file with only a permissions password is still encrypted. But its open password is empty, and the key is derived from that empty password. Every PDF viewer tries the empty password first, it works, and the document opens without asking you anything. The viewer then has the full, decrypted document in memory.

The restrictions are a separate number stored in the file, a set of on and off switches called the permission flags. They cover things like:

printing, and printing at full quality
changing the document
copying text and images
adding comments and filling in forms
extracting text for accessibility tools such as screen readers
inserting, deleting or rotating pages

Nothing about those switches is enforced by the encryption, and the specification says so in as many words: there is “nothing inherent in PDF encryption that enforces the document permissions”. It asks each viewer to read the flags and disable its own buttons. Well-behaved viewers do. Software that does not care about the flags simply ignores them, because by the time it could check them it has already opened the document.

So the permissions password is a request, written into the file, that well-behaved software respects. It is useful for signalling intent: “this is the final version, please do not edit it”. It is not security, and nobody who writes PDF software treats it as security.

We go through the practical side of this, including why the Print to PDF trick fails on exactly these files, in secured PDF will not print or copy.

How to tell which kind you have

You can work it out in a few seconds without any tools.

Open the file. If a password prompt appears before you see anything, it has an open password. That is the real lock.
If it opens straight away, try to print it, or to select and copy a line of text. If either is blocked, it has a permissions password only.
In Acrobat or Acrobat Reader, the title bar says (SECURED) for both kinds. The document properties panel, under Security, lists exactly which actions are allowed.

Or drop it into our unlock tool, which checks the file before it asks you for anything. If the file opens without a password, it says so and does not ask for one.

Which scrambling method was used

The strength of an open password depends on two things: how guessable the password is, and which method the file was locked with. PDF has used four over the years, and all four still turn up, because documents last longer than software.

Method	Introduced	Where you still see it
RC4, 40-bit	PDF 1.1, 1990s	Old archives, very old banking systems
RC4, 128-bit	PDF 1.4	Statements and reports from the 2000s
AES, 128-bit	PDF 1.6	Files from the Acrobat 7 and 8 era
AES, 256-bit	PDF 1.7 extension, then PDF 2.0	Anything modern

The 40-bit method is broken in a way the others are not. Its key is so short that it can be found by trying every possible key, whatever the password was, so a 40-bit file is only locked against people who have not looked it up. PDF 2.0, the current version of the standard, deprecates everything except 256-bit AES.

The rest of the picture, including what a locked file still gives away to anyone who opens it in a text editor, is in is PDF password protection secure.

Why your PDF is password protected in the first place

If a file arrived locked and you did not lock it, it is almost always one of these.

It came from a bank, a tax authority, a payroll system or an ID agency. These lock statements with a password built from details they already hold about you, such as a date of birth or part of an account number. The formats are published, and we have collected the common ones in what is the password for my bank statement PDF.
Your organisation applied a sensitivity label. Microsoft 365 can encrypt a document based on its classification, and a PDF exported from it inherits the label. This kind is tied to your work account rather than to a password, so there is no password to type and nothing a PDF tool can remove. Your IT team owns it.
Someone exported it with a permissions password to stop it being edited, and forgot it would also stop you printing it.

What removing a password actually does

Unlocking a PDF properly is the reverse of locking it. You supply the password (or, for a permissions-only file, nothing at all), the key is derived exactly as your viewer would derive it, and every piece of text and every image stream is unscrambled and written back out with the encryption entry removed.

The result is the same document. Same pages, same selectable text, same fonts, same bookmarks and form fields. That is different from the common workaround of opening the file and printing it to a new PDF, which produces a fresh copy drawn from scratch, loses the bookmarks and links, and does not work at all on a file whose permissions forbid printing.

Our tool does it in your browser, on your device, with nothing uploaded. It does not guess passwords and never tries a list of common ones. It removes a lock you can already open, which covers every permissions-only file, and any file you know the open password for.