Blog

Marking a PDF confidential: what it does and does not do

A watermark is a label, and a PDF permissions password is a polite request. Here is what each one actually stops, and what to use when it matters.

By Harish5 min read

A watermark across a page tells a reader how to treat the document. It does not stop them doing anything. Neither does a PDF permissions password, which is not a lock but a note to the viewer software asking it to hide the print button. Both are worth using, for what they are. Neither belongs in a sentence that starts “the document is protected because”.

This post explains what each one actually is, so you can pick the right one and not rely on it for more than it does.

What a watermark is, mechanically

A PDF page is a list of drawing instructions. Put this text here in this font at this size. Draw this image in this rectangle. A watermark is more of the same: extra instructions appended to the list, usually large text at low opacity, rotated across the middle of the page.

Ours draws the words in grey at fifteen percent opacity, scaled so the text spans the page, at forty five degrees if you pick diagonal. It is added to every page in the document.

Two consequences follow from that, and they are the two things people get wrong.

The text underneath is untouched. A watermark is drawn over the existing content, not instead of it. Every character of the original is still in the content stream in exactly the position it was. Select the page and copy it and you get the original text, plus the watermark word. Any extraction library returns the same. A watermark hides nothing.

It can be taken off. A watermark is an object in the file, and a file you have is a file you can edit. How clean the removal is depends on how the watermark was added. Where it is a separate drawing object in the page resources, which is what most stamping tools produce, it is an identifiable thing that can be dropped. Where it was merged into the main content stream it is harder to separate, and where the page was flattened to an image it cannot be separated at all without losing the text with it. Harder is not the same as protected. Assume anyone motivated will manage it.

So a watermark is a label. Labels are useful. A page stamped DRAFT does not get filed by mistake, a page stamped NOT FOR DISTRIBUTION reminds the reader of an obligation they already have, and a page stamped with the recipient’s own name is a real deterrent against forwarding, because a leaked copy identifies its source. That last one is the strongest use of a watermark and it works by attribution rather than by prevention.

What a PDF password is, and why there are two of them

This is the part that causes genuine confusion, because the two things are both called “password protection” in the same dialog box and only one of them does anything.

The user password, sometimes called the open password, is real. The file contents are encrypted, and without the password there is nothing to read. Modern PDFs use AES, and a file encrypted with a strong user password is protected in the ordinary sense of the word.

The owner password, sometimes called the permissions password, is not. It sets a group of flags in the file: may not print, may not copy text, may not edit, may not extract for accessibility. Those flags are never enforced by the encryption. They are enforced by the viewer, on the honour system. Acrobat respects them. Most commercial viewers respect them. Any PDF library, and there are dozens, reads the file and ignores them completely, because there is nothing in the file to stop it.

The practical summary:

Setting What it actually does
User password Encrypts the content. Real protection.
Owner password and permission flags Asks the viewer to grey out some buttons.
Watermark Labels the page. Changes nothing about access.
Redaction, done properly Removes content from the file permanently.

If you have ever set a permissions password and been surprised that a colleague copied the text anyway, that is not a bug in their software. It is the design.

Picking the right one

Work backwards from what you are actually worried about.

You want the reader to know the status of the document. Watermark. DRAFT, PRIVILEGED AND CONFIDENTIAL, SUBJECT TO CONTRACT, FOR SETTLEMENT PURPOSES ONLY. This is the common case and the watermark is the correct tool, not a weak version of a better one.

You want to know who leaked it. Watermark, with the recipient’s name or a reference number, a different one per copy. Keep a record of which copy went where. This is what per-recipient marking is for and it is genuinely effective, because it changes the recipient’s calculation rather than their capability.

You want someone without the password to be unable to read it. User password, with a strong password sent through a different channel than the file. Or better, do not send the file: put it somewhere with access control and send a link, so you can also revoke it and see who opened it.

You want to stop the recipient printing, copying or forwarding it. You cannot, with a PDF. A reader who can see a document can keep it. Rights management systems exist and they work by never giving the reader the real file, which is a different product with a different cost. If the requirement is genuinely this, a permissions flag is worse than nothing, because it produces a false belief that the problem is solved.

You want information out of the document entirely. Redaction, done with a tool that removes the underlying content rather than covering it. A black rectangle drawn over text is a watermark by another name: the characters are still there and still copyable.

Two practical notes

Watermark late. Most operations that rewrite a PDF will carry the watermark along, but the ordering that causes least surprise is to finish the document, then stamp it. Stamping before merging means you get to check the merged bundle looks right rather than finding out that half of it is marked DRAFT.

The watermark is not a substitute for checking the metadata. A document stamped CONFIDENTIAL still carries its author, its software and its timestamps in a place the stamp does not cover. If the file is going outside your organisation, look at those too. We wrote up what is hidden inside a PDF and, for documents heading to a docket, what leaves with a court filing.

Further reading