Blog

Is PDF password protection secure? What a locked file still shows

A modern PDF open password is real encryption, if the password is strong. But a locked PDF still shows its page count, fonts and sometimes the author name.

By Harish6 min read

PDF password protection is secure in one case and weak in several others. An open password on a file locked with 256-bit AES is real encryption, and if the password is long and random, nobody is reading that file without it. A permissions password is not security at all. The old 40-bit method is broken regardless of the password. And even a properly locked PDF leaves some things readable to anyone who opens it in a text editor, which we tested for this post.

The short answer, by case

How the PDF is protected Secure?
Open password, AES-256, long random password Yes
Open password, AES-256, a date of birth or a word No. The password can be guessed quickly
Open password, RC4 40-bit (old files) No. Breakable whatever the password
Open password, RC4 or AES 128-bit Reasonable with a strong password, but deprecated
Permissions password only (no printing, no copying) No. It is a request, not a lock

Everything in that table comes down to three separate questions: which password, which method, and how guessable the password is.

Question one: which password?

A PDF has two. The open password encrypts the content, and nothing shows you a page without it. The permissions password only switches off printing, copying or editing in viewers that choose to respect it, and the file itself is readable by anyone. We explain why in how PDF passwords work.

If the protection you are relying on is the kind where the file opens and Print is greyed out, it is protecting nothing. Any tool that ignores the flags, including ours, gives you a fully printable copy in one step.

Question two: which method?

PDF has used four encryption methods since the 1990s, and a locked file records which one it used.

RC4 with a 40-bit key was the original, shaped by the export restrictions on cryptography of the time. Forty bits is small enough that every possible key can be tried directly, so the password does not protect the file at all. You still find these in old archives.

RC4 and AES with 128-bit keys are not broken in that way, and a strong password holds up. But PDF 2.0, the current version of the standard, deprecates them.

AES with a 256-bit key, in the form defined for PDF 2.0, is the only method the standard still recommends, and it is what current versions of Acrobat and most other software produce. It also makes each password check deliberately slow, which matters for the next question.

Question three: how guessable is the password?

With any modern method, the only practical attack is guessing the password. The file stores a check value, not the password, so an attacker tries candidates until one produces a match. That makes the password the whole of your security.

This is why statement PDFs are the weak spot. A bank that locks statements with a date of birth has chosen a password with around 36,500 possibilities per century, which is no protection against anyone who has the file and a few seconds. The lock stops the file being readable by someone who picks it up by accident. It does not stop someone who wants in.

A long random password, generated by a password manager and sent separately from the file, is the version of this that is actually secure.

What a locked PDF still gives away

This is the part most articles skip, and it applies even to a perfectly locked file.

PDF encryption scrambles two kinds of thing inside the file: the streams, which hold page content, images and fonts, and the strings, which hold text values like the title and author. It does not scramble the structure that holds them together. So we locked a test file with a strong password using 256-bit AES, then opened the result as plain text, with no password, to see what was left.

Our test document was seven A4 pages, set in Times and Helvetica Bold, with an author name, a title and a producer string in its metadata.

What we looked for Readable without the password?
The page text No
Title, author and producer in the document info No
Number of pages (/Count 7) Yes
Page size (/MediaBox [0 0 595.28 841.89], which is A4) Yes
Font names (/BaseFont /Times-Roman, /Helvetica-Bold) Yes
The encryption method and permission settings Yes

None of that is a flaw in any particular product. It is how the format works: names like /Times-Roman are part of the structure rather than text values, so they are never encrypted. Most of the time it does not matter. Occasionally, a page count or a distinctive font is exactly what someone wanted to know.

The option that leaves your name in plain text

There is one more gap, and it is a setting rather than a rule.

A PDF can carry a second copy of its metadata in a block called the XMP packet, which holds the author, the company and the software that made the file. The specification lets whoever locks a file choose to leave that block unencrypted, through a setting called EncryptMetadata, so that search and document management systems can still index it. Software that locks PDFs can offer this as an option, and qpdf has a flag for it.

We tested that too. We took a PDF whose XMP names an author and a company, locked it with 256-bit AES and a strong password, once with the metadata encrypted and once without. With the metadata left in the clear, the file showed this to anyone, no password needed:

<rdf:Description dc:creator="Jane Doe" dc:publisher="Acme Holdings Ltd"/>

The page text was locked. The name of the person who wrote it and the company they work for were not.

A strong lock, opened in the wrong viewer

One more result is worth knowing, because it shows the limits of the whole scheme. In 2019, researchers at Ruhr University Bochum published PDFex, a set of attacks on encrypted PDFs that never recover the password at all. The attacker alters the locked file so that when the rightful recipient opens it and types the password, their viewer sends the decrypted content out, through a form or a link. They tested 27 widely used viewers and found every one vulnerable.

Viewers have been patched since, and the attack needs someone to intercept and alter the file on its way to you. But it makes a point that stays true: PDF encryption protects a file sitting on a disk or in an inbox. It does not prove the file you received is the file that was sent.

How to lock a PDF so the lock means something

  1. Use an open password, not only a permissions password. Only the open password encrypts anything.
  2. Make the password long and random, and send it by a different channel from the file: a text message for a file sent by email, for example.
  3. Use 256-bit AES. In Acrobat, choose the highest compatibility level on offer. Older levels select older methods.
  4. Strip the metadata before you lock the file. Encryption hides it only if the metadata option is set correctly, and once the file is locked you cannot easily check. Removing the author, company and software names first means there is nothing there to leak either way. We cover what a PDF stores about you in what is hidden inside your PDF.
  5. Remember what stays visible. Page count, page size and fonts are readable whatever you do. If those matter, a PDF password is not the right tool, and an encrypted archive or a secure file transfer service is.

Further reading