How to Secure a PDF: Passwords, Permissions and Proper Redaction

A council publishes a report with names blacked out. Within hours someone selects the text under the black rectangles, copies it, and pastes the names into a public forum. Nothing was hacked. The rectangles were drawn on top of the text, and the text was still in the file.

Variations of this happen to organisations that could well afford to know better, and they happen because the words used around PDF security are misleading. This guide explains what each protection actually does, where the common assumptions are wrong, and how to secure a PDF in a way that survives contact with someone who knows what they are doing.

Three Different Things, Often Confused

Almost every PDF security mistake comes from treating these as interchangeable. They are not.

• Encryption stops someone opening the document without a password. It is genuine cryptographic protection.
• Permissions ask a PDF reader to restrict printing, copying or editing. It is a request, not enforcement.
• Redaction permanently removes specific content from the file. It is the only one that actually deletes anything.

Understanding which problem you have determines which of the three you need — and using the wrong one is how confidential information ends up published.

Passwords: Two Kinds, Very Different Strength

The open password

Also called a user or document-open password. This encrypts the file contents. Without the password the document cannot be opened, and there is no supported way around that. Modern PDF tools use AES encryption, and with a strong password this is real protection.

Its weaknesses are practical rather than cryptographic. The password has to reach the recipient somehow — and emailing the password in the same message as the document, or in a follow-up to the same inbox, removes most of the benefit. Send it by a different channel.

Password strength also matters more than people assume. A short or guessable password on an encrypted PDF is attackable offline, at whatever speed the attacker's hardware allows, with no lockout to stop them.

The permissions password

Also called an owner password. This sets restrictions — no printing, no copying, no editing — while leaving the document openable by anyone.

Here is the part worth internalising: these restrictions are honoured voluntarily by the PDF reader. Compliant software respects them. Plenty of software does not, and tools that strip them are freely available. A permissions password is a reasonable way to signal intent and prevent casual copying by colleagues. It is not a control you should rely on for anything confidential.

If the information genuinely must not be copied, the answer is not to send it to that person, or to redact it, or to encrypt the whole file — not to tick "disallow copying" and hope.

Redaction: The One That Actually Removes Things

Drawing a black rectangle over text hides it visually and changes nothing underneath. The text remains in the file, selectable and extractable. The same applies to a white box, a highlighter mark, or an image placed on top.

Proper redaction removes the underlying content and replaces it, so there is nothing left to recover. Most professional PDF tools have a specific redaction function that does this in two stages — marking, then applying — and the applying step is the one people skip.

A working redaction process:

1. Work on a copy. Redaction is irreversible by design.
2. Search rather than scan visually. Use text search for names, account numbers, reference codes and email addresses — human eyes miss instances, particularly in long documents.
3. Mark everything, then apply. Marking alone does nothing.
4. Check the whole document, including headers, footers, captions, footnotes, table cells and appendices.
5. Check images for visible text — a screenshot or scan containing a name is not caught by text search.
6. Remove metadata separately. Redaction does not touch document properties.
7. Verify by searching the finished file for the terms you removed. If anything returns a result, the redaction did not apply.

Metadata: What Travels Without Being Visible

A PDF carries information that never appears on any page:

• Author name and the account that created it
• The software used, and sometimes the original file path — which can reveal internal folder structures and client names
• Creation and modification dates
• Title and keyword fields, often left from whatever template was used
• Embedded XMP data from design applications
• In some cases, earlier versions of edited content

For a document going to a regulator, a court, an opposing party or the public, metadata deserves the same attention as content. Most tools offer a document sanitisation or "remove hidden information" function that clears it properly.

Certifying and Signing

A different kind of security: not restricting access, but proving the document is genuine and unaltered.

A digital signature applies a cryptographic hash. If a single byte changes afterwards, the signature reports as invalid. This detects tampering rather than preventing it, which for contracts and official records is usually what you want. A certifying signature goes further and records which changes — if any — are permitted afterwards.

Two practical consequences. Signing should be the last step, because any later edit or compression breaks it. And a visible signature image is not the same as a cryptographic signature — the distinction, and which one your situation calls for, is covered in electronic versus digital signatures on PDFs.

Securing Forms and Collected Data

Fillable forms add a second surface. The form itself may be public while the completed submissions contain personal data.

• Decide how completed forms come back. An email submit button sends data to whichever address is hard-coded in the form. If that is a personal inbox and the form collects health or financial information, no amount of file-level security fixes it.
• Flatten completed forms for archiving, which merges answers into the page — but keep the unflattened master separately.
• Do not rely on a permissions password to protect submitted data.
• Agree retention and access before the form is distributed, not after the submissions arrive.

The form-side considerations are covered more fully in professional fillable PDF forms.

What Encryption Does Not Cover

Encrypting a PDF protects the file. It does not protect the information once someone legitimately opens it, and that gap is where most real-world leaks happen.

• An authorised recipient can do anything. Once opened, the contents can be screenshotted, retyped, photographed or forwarded along with the password. Encryption controls access, not behaviour.
• The password is the weak point. Shared in a group chat, saved in a shared document, or reused across every file your organisation sends — all common, all removing the protection.
• Encryption does not expire. A password sent two years ago still works. If access needs to be revocable, a document platform with per-user permissions is the right tool, not a password on a file.
• It leaves no audit trail. You cannot tell who opened it or when.
• It does not classify anything. A recipient who was never meant to receive the file, but was forwarded it with the password, has full access.

For genuinely sensitive material shared regularly, file-level passwords are usually the wrong layer. They suit one-off transfers to a known recipient. Ongoing access to confidential documents belongs in a system that can log, revoke and expire.

Matching the Protection to the Risk

Common Mistakes

• Black rectangles used as redaction. The most damaging mistake available.
• Marking redactions without applying them.
• Redacting the text but leaving it in an embedded screenshot.
• Treating a permissions password as protection.
• Sending the password in the same email as the file.
• Forgetting metadata, so the document is clean and the properties are not.
• Compressing or editing after signing, which invalidates the signature.
• Securing the document but not the return channel for completed forms.
• Applying a password to the only copy and losing it. There is no recovery.
• Assuming a flattened PDF is anonymous. Flattening merges form data into the page; it does not remove metadata.

A Practical Checklist Before Anything Leaves

1. Does this document contain anything that should not be in it? Redact properly and verify by copy-paste.
2. Have I cleared the metadata?
3. Does the recipient need to prove it is unaltered? Sign it — last.
4. Should only specific people be able to open it? Encrypt, and send the password separately.
5. Am I confusing "restricted" with "protected"?
6. Have I kept an unsecured master somewhere I can find it?

Conclusion

PDF security is less about tools than about matching the protection to the actual risk. Encryption controls access. Redaction removes content. Signatures prove integrity. Permissions are a polite request that some software ignores.

If you take one thing from this: after redacting anything, copy the text out of the finished file and read it. That single check would have prevented most of the publicised redaction failures of the last decade.

This article describes how PDF security features behave technically. It is not legal advice — where handling personal or regulated data, check your own obligations under the rules that apply to you.

Getting Documents Prepared Securely

SBTEXMEDIA provides PDF editing and document preparation for businesses, legal firms, healthcare providers, schools, NGOs and government organisations — proper redaction with verification, metadata sanitisation, encryption and permission settings applied appropriately, flattening of completed forms, and preparation of documents for publication, disclosure or submission. Where a requested protection would not actually do what a client expects, that is said plainly before work starts.

Related work on professional PDF editing and file size optimisation is handled by the same team — useful to know, since compressing a signed document breaks its signature.

You can see examples on the portfolio, browse the full range of services, or describe what the document needs to protect against for a fixed quote and a delivery date before work begins. More guides are on the SBTEXMEDIA blog.