PDF Studio › Guides › PDF passwords explained: open password vs permissions password
PDF passwords explained: open password vs permissions password
A PDF can have two different passwords, and they protect very different things. Mixing them up is how people end up with files that feel locked but are not. Here is what each one does.
The two passwords
| Open password (user password) | Permissions password (owner password) | |
|---|---|---|
| What it controls | Whether the file can be opened at all | What someone can do after opening it: print, copy, edit |
| How strong it is | The content is encrypted; without the password it is unreadable | Depends on the reading program respecting the settings |
| Who should know it | Everyone who needs to read the file | Only the person who manages the file |
| Typical use | Bank statements, salary slips, medical reports | Stopping casual copying or editing of a shared document |
The open password is the real lock
When a PDF has an open password, its contents are encrypted. No PDF reader can show the pages without the password, because without it the data is scrambled. How hard it is to break depends on two things: the encryption method, and the password itself.
Older PDFs used 40-bit RC4 encryption, which modern computers can break quickly regardless of the password. Newer files use 128-bit RC4 or AES with 128 or 256 bits, where the weak point becomes the password. A short or guessable password, such as a date of birth, can be found by trying likely combinations, however strong the encryption.
Permissions are a polite request
Print, copy and edit restrictions are flags inside the file. Adobe Acrobat, browsers' PDF viewers and mainstream phone apps honour them: the print button is disabled, text will not select. But anyone who can open the file can see its content, and some software simply ignores the flags. Screenshots are always possible.
So permissions are useful to stop accidental changes and casual copying, and to make intent clear. They are not a way to keep content secret. If the content is sensitive, it needs an open password.
Choosing a PDF password
- Length beats tricks. Four or five random words, like
river-lamp-orange-desk, are much harder to guess thanPass@123and easier to type on a phone. - Avoid personal details. Names, birthdays and phone numbers are the first things anyone guessing will try. Statements that are protected with details like date of birth are only as safe as those details are private.
- Do not reuse an important password, such as your email or banking password.
- Share it separately. Email the file, and send the password by phone call or a different messaging app. If one channel is compromised, the other still protects the file.
Setting passwords with PDF Studio
Protect PDF lets you set either or both. Type a password to open; optionally set an owner password; and choose whether printing, copying text and editing are allowed. Leave the owner password empty and the open password is used for both. To restrict printing or copying without requiring a password to open, leave the open password empty and set only an owner password. Every file is encrypted with 128-bit AES, whatever PDF version it started as.
Removing a password
If you know the open password and want an unprotected copy, Unlock PDF creates one. It rebuilds each page as a high-quality image, so the copy looks the same but its text can no longer be selected. Many PDF readers can also "print to PDF" an open file, which often keeps the text.
If you have lost the password, there is no legitimate shortcut. Ask the sender for a new copy, or go back to your unprotected original. Keep originals of anything you protect.
Questions people ask
Can I add a password to a PDF on my phone?
Yes. Protect PDF works in mobile browsers and saves the protected copy to your phone.
Why does my PDF open without a password but will not let me print?
It has only a permissions (owner) password with printing turned off. The owner password is needed to change that.
Does a password make the file bigger?
Hardly. Encryption changes the data, not how much of it there is.