PDF security is the most-misunderstood corner of everyday document work. People routinely over-protect files that don't need it — adding passwords to every contract they send, regardless of recipient — while under-protecting the files that actually matter, like scanned identity documents or medical records. The goal of this guide is to give you a working mental model of PDF passwords, encryption, and permission controls, so you can protect what genuinely needs protection without turning every shared file into a nuisance.
The two kinds of PDF passwords
PDF supports two different passwords, and they do different things. The user password (sometimes called the open password or document-open password) is what you type to open the file at all. Without it, you can't read the PDF. The owner password (sometimes called the permissions password) controls what you can do once the file is open — print, copy text, edit, extract pages, fill forms. A PDF can have either password, both, or neither.
In practice, the user password is the only one with real teeth. When a PDF is protected with a user password, the file contents are actually encrypted on disk — an attacker who steals the file can't read it without the password (assuming modern encryption, which we'll get to). The owner password is different: the file is not meaningfully encrypted against casual reading, but a polite PDF reader will enforce the permission restrictions. Impolite readers, or simple unlock tools, can remove owner-only restrictions quickly. If the contents of the file are sensitive, a user password is what you need. Owner passwords are a politeness layer, not a security layer.
How strong is modern PDF encryption?
A PDF protected with a strong user password and a modern encryption algorithm is genuinely hard to break. The current standard (AES-256, sometimes called PDF 2.0 security) is as strong as the encryption used for online banking. In practice, the encryption strength is almost never what fails — the password is. A five-character dictionary word as a user password can be cracked in minutes by a brute-force tool. A 16-character random password would take longer than the age of the universe with current hardware.
If you are going to password-protect a PDF, pick a password as carefully as you'd pick a banking password. Long, not reused, not a dictionary word, not a birthday, and stored in a password manager. A weak password on a strongly encrypted PDF is exactly as secure as a weak password — the encryption algorithm does not save you.
When should you actually password-protect a PDF?
Use a password when the file contents are sensitive and the sharing channel is not already private. Examples that genuinely need a password: medical records sent by email; financial statements sent to a client; legal contracts with confidentiality clauses; identity documents (passport scans, ID cards, residence permits); internal HR letters; board materials shared before they are made public.
Skip the password when the channel is already private (for example, a file shared inside an already-authenticated corporate cloud drive), when the content is not sensitive (a product brochure, a public report), or when the recipient is unlikely to have a password manager and the password will just cause a back-and-forth over SMS. A password that gets written on a sticky note or sent in the body of the same email is worse than no password at all.
How to password-protect a PDF
- Decide whether you need a user password, an owner password, or both. For most sensitive files, start with a user password only.
- Generate a strong password. Use a password manager's generator, not your imagination.
- Open the Protect PDF tool. Upload the file, enter the password, and confirm.
- If you also want to restrict actions (no printing, no copying), set an owner password and pick the permissions you want to block.
- Run the protection job and download the protected PDF.
- Test the output. Open the protected PDF in a viewer and confirm it prompts for the password.
- Deliver the password through a different channel than the file. If the file goes by email, send the password by SMS, by a password-manager shared item, or spoken in a phone call.
How to unlock a PDF (the legitimate way)
Unlock tools are routinely misunderstood as hacking tools. In practice, the most common reason to unlock a PDF is that you are the owner and you want to remove the password now that it is no longer needed — for example, a bank statement you downloaded months ago that is still password-protected every time you open it. An unlock tool removes the password when you already know it, or it removes permission restrictions that were set with an owner-only password (a polite request the file was making, not a security wall).
- Confirm you have the right to unlock the file. This is always yes for your own documents. It is never yes for documents belonging to a third party that did not give you permission.
- Open the Unlock PDF tool. Upload the protected file.
- If the PDF has a user password, enter it when prompted. The tool cannot unlock a user-password-protected PDF without the correct password.
- If the PDF only has owner restrictions (printing disabled, copying disabled, editing disabled), the unlock tool can lift those restrictions.
- Download the unlocked file and archive it under a clear name.
A legitimate unlock tool will refuse to open a user-password-protected file without the password. Any tool that claims to brute-force an open password for you is either a scam or a security risk. Do not upload sensitive files to those services.
Security myths that still fool people
- Myth: adding a password to a PDF hides the contents from the email provider. In transit over TLS, yes. At rest on the provider's servers, the provider usually only sees the encrypted blob — but if you attach the PDF and the password in the same email, you have canceled the protection.
- Myth: the "disable copying" permission protects sensitive text. It does not. Anyone with a PDF reader that ignores the permission — or an unlock tool, or even a screenshot — can read the text in seconds.
- Myth: flattening a PDF (turning every page into an image) is security. Flattening makes text harder to extract but does not encrypt anything. A screenshot of a single page gives the attacker all the visual information they need.
- Myth: locking the PDF prevents printing permanently. Most PDF readers respect the no-print permission politely, but there are PDF readers that ignore it and there are tools that strip the owner password in seconds. If printing must be prevented, don't share the file.
- Myth: redacting with a black rectangle shape hides the underlying text. It does not. The text is still there underneath; only the display is covered. Real redaction permanently removes the text from the file.
Sharing protected PDFs safely
Three practices separate a safe share from a risky one. First, deliver the password through a different channel than the file. Email the PDF, text the password (or vice versa). Never, ever put both in the same email. Second, rotate passwords when the file's sensitivity declines — a quarterly report password can probably be retired after the quarter. Third, keep a record of who received which password. If you later suspect a leak, knowing which recipient had which password is how you trace it.
What OkFarsi can and cannot do
The OkFarsi Protect PDF tool applies AES-256 user-password encryption and optional owner-password permission restrictions to your PDF. The Unlock PDF tool removes password protection on files where you are the authorized user and already know the password. Neither tool attempts to brute-force user passwords — that is a line we deliberately do not cross. Both tools run in isolated workers and delete your files shortly after you download the result. The password you enter to protect a file is used exactly once, to encrypt the file, and is never logged or retained on our servers.
Ready to protect or unlock?
If you are shipping something sensitive, open the Protect PDF tool, pick a strong password, and encrypt the file. If you have your own PDFs that have outlived their need for protection, open the Unlock PDF tool, enter the password, and clear them. And if you only remember one thing from this guide: the password is the weak link, not the algorithm. Pick a good one.