Encrypting the file
- Open Protect PDF and add your document.
- Enter an open password — the one the recipient will type to view the file.
- Confirm it, apply the protection, and download the encrypted copy.
- Close and reopen the downloaded file yourself to verify the prompt appears before you send it anywhere.
That verification step takes five seconds and catches the worst possible outcome: sending an unencrypted file while believing it is protected.
Open password vs permissions password
PDFs support two different passwords and they are not equally meaningful.
The open password (also called the user password) encrypts the file's contents. Without it, the document cannot be read at all — the bytes are unreadable, not merely hidden. This is the one that provides actual security.
The permissions password (owner password) sets flags like "no printing" or "no copying". Compliant readers honour these; plenty of software ignores them entirely. Treat permissions as a courtesy signal to well-behaved software, never as protection for sensitive material.
Choosing a password that is worth setting
Encryption strength is irrelevant if the password is Invoice2026. A short or predictable password falls to an offline guessing attack quickly, because the attacker has the file and unlimited attempts.
- Use a passphrase of four or more unrelated words, or 12+ mixed characters.
- Never reuse a password across different recipients or documents.
- Avoid anything derivable from the document — the client's name, the invoice number, the date.
- Store it in a password manager; a file whose password is lost is genuinely unrecoverable.
The mistake that undoes everything
Sending the encrypted PDF and the password in the same email is the single most common failure. Anyone who reads that message — or intercepts it, or finds the mailbox later — has both halves. Encryption bought you nothing.
Send them separately: file by email, password by phone call, SMS, or a messaging app. Better still, agree the password in advance so it never travels alongside the document at all. For recurring recipients, a shared passphrase agreed once in person beats a new password emailed every month.
Do the encryption last
Encryption should be the final step in your workflow. An encrypted file usually has to be decrypted before other tools can touch it, so if you still need to combine documents, add a signature, or shrink the file with Compress PDF, do all of that first and protect the finished result once.
When a password isn't the right tool
Password protection controls who can open a file. It does not control what happens next — the recipient can forward the document, save an unprotected copy, or share the password. For material that must remain controlled after delivery, you need a system with access revocation and audit logs, not an encrypted attachment. And for very large or highly regulated transfers, a secure file-sharing service with expiring links is a better fit than email.
Frequently Asked Questions
Can a password-protected PDF be cracked?
Modern AES encryption is not broken directly, but weak passwords are guessed offline. Strength comes almost entirely from the passphrase you choose.
What happens if I forget the password?
The file cannot be opened. There is no recovery mechanism and no backdoor — which is precisely why it works. Save the password in a manager when you set it.
Can the recipient remove the password?
Yes, once they can open the file they can save an unprotected copy. Encryption protects the document in transit and at rest, not after the recipient has it.
Does password protection change how the PDF looks?
No. Pages, text, and images are identical. The only difference is the password prompt when the file is opened.