PDF password protection is widely used but poorly understood. Here is how the RC4 and AES encryption inside a PDF actually work, and why an owner password is not the same as a user password.
Password-protecting a PDF feels like a single action, but under the hood the format supports two distinct passwords and two distinct layers of encryption. Understanding the difference matters whether you are securing a contract before sending it or trying to recover a file you locked yourself out of.
The two passwords in a PDF
A secured PDF can carry a user password (also called the open password) and an owner password (also called the permissions password). The user password is required simply to open and view the document. The owner password is required to change the permissions that restrict what a reader can do: printing, copying text, filling forms, or assembling the document.
A file can have either or both. A bank statement might set only a user password so the recipient can open it but the bank retains no permission restrictions. A draft contract might set only an owner password so anyone can read it, but no one can copy the text or print it without the owner password. Most secured documents set both.
How the encryption actually works
The PDF specification has gone through several encryption revisions. Early versions used RC4, a stream cipher with a 40-bit or 128-bit key. Modern PDFs use AES (Advanced Encryption Standard) with 128-bit or 256-bit keys, usually in CBC mode with a per-file initialization vector. The 256-bit AES variant introduced in PDF 2.0 is the current standard for anything sensitive.
The password you type is not used directly as the encryption key. Instead, the PDF software derives a key from the password using a key derivation function — historically a series of MD5 hashes with padding, and in newer revisions PBKDF2 with many iterations of SHA-256. The derived key decrypts the actual file key, which in turn decrypts the streams and strings inside the document. This indirection is why changing a permission does not require re-encrypting the whole file.
What permissions actually restrict
The owner password controls a permission flags field that tells conforming viewers which actions to allow. The flags cover printing (and a separate low-resolution print flag), modifying content, extracting text, annotating, filling forms, and accessibility extraction. Crucially, these are advisory: a compliant reader honours them, but a non-compliant tool can ignore them. Permissions are a courtesy layer, not a cryptographic guarantee. The encryption itself is the real protection — if the file is encrypted, the content cannot be read without the key regardless of the permission flags.
What unlocking a PDF means
When you unlock a PDF with the Unlock PDF tool, you supply the owner or user password, the tool derives the key, decrypts the file, and rewrites it without encryption and without permission restrictions. The result is a plain, unrestricted PDF. This is only possible when you genuinely know the password — the tool performs a legitimate decrypt, not a crack. If you have forgotten the user password of a strongly encrypted AES-256 file, recovery is computationally infeasible.
Choosing the right protection
- Use a user password when the content itself is confidential and only the recipient should see it.
- Use an owner password when the content is viewable by anyone but you want to discourage copying, printing, or editing.
- Prefer AES-256 over RC4 or AES-128 for anything containing financial, legal, or personal data.
- Use a long, random password. Key derivation slows brute force, but a short password is still the weak link.
- Keep a backup of the password in a password manager. There is no recovery path for a lost AES-256 user password.
Browser-based vs server-based decryption
Most online PDF unlockers upload your file to a server, decrypt it there, and return the result. That means your password and the decrypted contents both pass through infrastructure you do not control. A browser-based tool decrypts locally using WebAssembly and in-browser crypto libraries, so the password you type and the decrypted bytes never leave your device. For a document protected because it is sensitive, that is the only model that makes sense.
Encryption is a strong tool when used correctly and a false sense of security when used carelessly. Pick the right password type, use AES-256, store the password safely, and decrypt locally whenever the contents are sensitive.