PDF Protector

Introduction

A PDF often leaves the place where it was created. It may be attached to a board pack, sent to a client, shared with reviewers, archived with business records, or moved through ordinary file-sharing systems. Password protection is useful when the document should remain a normal PDF but still require a secret before the pages can be opened.

PDF protection has two passwords with different jobs. The open password, sometimes called the user password, controls access to the encrypted document. The owner password controls security changes and is tied to permission flags such as printing, copying text, editing pages, filling forms, adding annotations, or assembling pages. The open password is the gate. The permission flags are instructions that conforming PDF readers are expected to honor after the file is decrypted.

Those permission flags are often misunderstood. They are not the same as redaction, digital signatures, managed document rights, or secure storage. Once a recipient can decrypt and view a file, software behavior matters: a conforming reader should respect the restrictions, but a tool that ignores PDF permissions may still expose content after the password has been supplied. Protection should therefore be treated as access control for the document copy, not as a guarantee that every downstream program will enforce every rule.

Reader compatibility also shapes the choice. AES-256 standard security is the normal target for current protected copies, while AES-128 compatibility may be needed when a recipient uses an older or limited reader. Metadata encryption should stay on unless a receiving system explicitly needs visible title or author fields. Signed or already encrypted PDFs need extra care because rewriting the file can invalidate signatures or require owner-approved access to existing security settings.

• Protect only documents you own, administer, or have explicit permission to handle.
• Use a long unique passphrase and share it through a separate approved channel.
• Remove sensitive content before protection; do not rely on password protection as redaction.
• Test the protected copy in the reader your recipient will use, especially when permission restrictions matter.

The practical finish is not just an encrypted file. It is a new PDF that opens with the intended password, rejects an incorrect password, preserves the pages you expect, and behaves acceptably in the recipient's PDF reader.

How to Use This Tool:

Start with one owner-approved PDF and avoid placing password values in notes, screenshots, exported reports, or chat.

1. Select the source with Browse PDF or the drop area. The local scan checks the PDF header, tail marker, object hints, encryption dictionary, signature markers, interactive content, and metadata signals.
2. Turn on Authorization confirmation. The Protection Gate remains blocked until ownership or explicit permission is confirmed.
3. Enter an Open password. Aim for Strong or High; Weak and Fair passwords stop the protection run.
4. Choose the Permission profile. If the profile restricts printing, copying, forms, annotation, assembly, or editing, enter a distinct Owner password.
5. Keep AES-256 PDF standard security for ordinary protected copies. Use AES-128 compatibility mode only for a recipient reader that needs it, and keep Encrypt metadata on unless visible metadata is required.
6. Open Advanced only when the target filename or Browser scan limit needs adjustment. The default local work limit is 80 MB, and the control accepts 10 MB to 200 MB.
7. Run Protect PDF after the gate rows pass. If the source is oversized, already encrypted, signed, missing a PDF header, or using a weak open password, correct that condition before continuing.
8. Download the result from Protected PDF, then read Password verification and test the file with the intended password and a deliberately wrong password in a PDF reader.

Interpreting Results:

Protection Gate is the readiness checklist. A trustworthy run has confirmed authorization, a valid PDF source, a file within the configured local limit, a strong open password, suitable owner-password handling, no existing encryption blocker, no signature blocker, and an output that passes password verification.

File Evidence is a practical structure check, not a forensic PDF audit. PDF header and EOF marker catch obvious wrong files and incomplete downloads. Encryption dictionary set to found means the source already appears protected and should not be protected again without an approved rewrite path. Signature markers need review because encryption rewrites can invalidate signed byte ranges.

Password verification carries the most weight after encryption. The protected copy should contain an encryption marker, open with the supplied open password, and reject a wrong password. If verification reports review, do not share the download until the file is regenerated or tested through another approved PDF workflow.

A Strong or High password label is not proof that the password is new, private, or safe to share broadly. Use the meter as a first-pass warning, then manage the secret through your normal password manager or secret-sharing process.

Technical Details:

PDF standard security encrypts the document with a file encryption key. The open password and owner password are used by the standard security handler to recover or authorize use of that key. Permission flags record requested operations, but after a reader has enough information to decrypt the file, enforcement depends on the reader honoring the PDF security rules.

A protected copy is a rewritten PDF, not a generic archive wrapped around the original. That distinction is important for compatibility because PDF readers understand document-open passwords, owner passwords, permission flags, encrypted metadata, and the security dictionary. It also explains why signed or already encrypted PDFs require review: changing bytes can break signatures, and existing security settings may require owner-approved handling.

Rule Core:

The protection run follows a gate-and-rewrite pattern. File checks establish that the selected source is a suitable unencrypted PDF, password checks prevent weak or ambiguous secrets, and output checks verify password behavior before the download is treated as ready.

Permission Profiles:

Formula Core:

The password meter estimates a brute-force search space from character length and detected character groups. It does not check reused, common, compromised, patterned, or organization-specific passwords.

A 20-character password using lowercase, uppercase, digits, and symbols has an alphabet estimate of 95, so the displayed estimate is about 20 * log2(95), or 131 bits. A 16-character password can exceed 95 estimated bits but still show Strong rather than High, because the high label also requires at least 18 characters.

Protection Path:

The source is sampled for PDF markers before encryption. The beginning of the file is checked for %PDF-, the tail sample is checked for %%EOF, and visible structure markers are counted for pages, objects, streams, encryption, signatures, forms, attachments, JavaScript, and metadata. Compressed or encrypted object streams can hide exact counts, so these signals are readiness clues rather than a complete parse.

When the gate passes, the PDF is encrypted with the selected AES target, permission profile, owner-password handling, and metadata choice. The resulting copy is then opened with the supplied open password and tested with a wrong password. That verification does not prove every recipient reader will enforce every permission flag, but it does prove the basic password gate on the generated file.

Limitations and Privacy Notes:

The selected PDF bytes and password values are used in the browser session for scanning, encryption, verification, and download. Password values are not written to CSV, DOCX, JSON, or row-copy exports; those reports include posture information such as length, estimated entropy, and whether the owner password is distinct.

• The browser loads the qpdf runtime from a public CDN, so normal page and resource requests still occur.
• The selected PDF itself is not uploaded by this workflow.
• Very large PDFs can exceed browser memory even when the scan limit is raised.
• Permission flags are not a substitute for redaction, legal controls, or managed document rights.

Worked Examples:

Board packet ready for distribution

A 42-page, 7.8 MB board packet is selected, Authorization confirmation is on, and the open password reaches High. With Print allowed, block copy/edit, a distinct owner password, AES-256 PDF standard security, and encrypted metadata, the expected path is Protection Gate passing, Protected output becoming ready, and Password verification reporting that the correct password opens while a wrong password fails.

Signed approval form stops at review

A signed approval PDF has a visible Signature markers signal after the local scan. Even with a strong open password and valid PDF header, Protect PDF should remain blocked because rewriting an encrypted copy can invalidate the signed byte range. The corrective path is to confirm the signing workflow or protect a clean unsigned copy before signing.

Already encrypted supplier file

A supplier form already asks for a password when opened. The scan reports Encryption dictionary as found, sometimes with visible version, revision, key length, or permission bits. Treat that as an existing protected PDF and use an authenticated owner-approved rewrite path rather than applying another protection pass.

Oversized source or fake PDF

A 132 MB source exceeds the default 80 MB Browser scan limit, so the file is marked Oversize until the limit is raised on a capable browser or the document is handled elsewhere. A renamed image fails differently: PDF header is missing, the source becomes invalid, and the fix is to choose a real PDF.

FAQ:

Glossary:

Open password

The password required to decrypt and open the PDF for reading.

Owner password

The full-access password associated with permission management and security changes.

Permission flags

PDF settings that ask conforming readers to allow or block actions such as printing, copying, editing, annotation, forms, and assembly.

Encryption dictionary

The PDF structure that records security-handler settings such as encryption version, revision, key length, and permission value.

PDF header

The file-opening marker that identifies a document as a PDF and usually includes the PDF version.

Metadata

Document information such as title, author, and workflow details that may disclose information outside the page text.

Signature markers

Visible signs of a digital signature or timestamp whose signed byte range can be invalidated by rewriting the file.

References:

• PDF Encryption, qpdf documentation.
• Running qpdf, qpdf documentation.
• Securing PDFs with passwords, Adobe Acrobat Help.
• NIST SP 800-63B: Authentication and Authenticator Management, National Institute of Standards and Technology.