PDF passwords: open passwords versus permission restrictions

Two passwords, two jobs

The user password, often called the open password, is needed to open the document. The owner password, sometimes called the permissions password, controls what is allowed once it is open.

Apple's Preview on Mac shows the split clearly. Under File > Export, the Permissions button offers Require Password To Open Document, and a separate Owner Password section. Each action you tick, such as printing or making changes, is allowed without the owner password; anything left unticked needs it. The two passwords can be the same or different.

Inside the file, both passwords lead to the same thing: the key that decrypts the content. The difference is in how the reader behaves. According to the QPDF manual, a conforming reader is supposed to obey the restrictions when the file is opened with the user password, and not when it is opened with the owner password. So the owner password is the one to keep to yourself.

What permissions can control

The QPDF manual lists the permission flags a PDF can carry. The main ones:

• Printing, at low resolution or at full resolution.
• Modifying the document.
• Extracting text and graphics, which is what copying uses.
• Adding or changing annotations and filling in form fields.
• Assembling the document: inserting, rotating or deleting pages.

Restrictions are a request, not a lock

A file with restrictions but no open password still uses encryption, with an empty user password. Any reader can therefore decrypt it and show it. A conforming reader is then supposed to obey the restrictions. As the QPDF manual puts it, the security of these restrictions is solely enforced by the software, and they only restrict users who don't know how to get around them.

An open password is different. Without it, the reader can't get the encryption key, so the content stays unreadable. Note that only strings and streams in the file are encrypted, which covers the text and images; some structural parts are not.

How strong the encryption is

PDF encryption has changed over the years. The oldest 40-bit scheme always uses RC4, and its key can easily be brute-forced. 128-bit encryption can use RC4 or AES, with AES available from PDF 1.6. 256-bit encryption always uses AES.

PDF 2.0 (ISO 32000-2) deprecates weak schemes, and only AES-256 in a secure scheme is encouraged. If you protect a file yourself, choose AES-256 when your software offers it, and don't share the password in the same email as the file.

If you have forgotten the password

If someone sent you the file, ask them for the password or for an unprotected copy. If the file is your own, look for the source document, such as the word processor file, or an earlier unprotected copy, and protect a fresh export.

Our tools never guess or crack passwords. Unlock PDF removes an open password only if you type it into the Open password field.

Use it responsibly

Remove passwords and restrictions only from your own files, or when you have the owner's permission. Restrictions often reflect a decision someone made about their document, and removing them doesn't change any agreement you have with them. If a document is signed, unlocking it is a change too, so its signature will no longer validate.

What Unlock PDF does

Unlock PDF removes permission restrictions on printing, copying and editing from PDFs that open without a password. For a file with an open password, it removes the password when you enter it in the Open password field. Everything happens in your browser and the file is not uploaded.

Merge PDF, Split PDF, Organize PDF pages and Compress PDF also remove such restrictions automatically, and they tell you when they do.