Written plainly, including the parts that are less reassuring, because a false sense of safety is worse than none.
One of the choices on the Protect page is a genuine lock. The others are useful, but they are not the same kind of thing, and it matters that you know which is which before you send a document to somebody.
| Choice | What it is | Holds? |
|---|---|---|
| Password to open | Real encryption. Without the password the contents are unreadable, and no amount of poking at the file changes that. | Yes |
| Limits on printing, copying, editing | A rule written into the document asking software to refuse those things. Ordinary readers honour it. | Not guaranteed |
| No text left to copy | The words are removed and replaced with pictures of themselves. There is nothing left to select. | Yes |
When you set a password, the document is encrypted with AES-256, the same standard used to protect banking and government material. Your password is not stored in the file. What goes in is a one-way check value and the document's own randomly generated key, sealed so that only your password opens it.
Two consequences worth understanding:
Nobody can look inside without the password. Not us, not the software, not somebody who has the file sitting on a disk. The text and pictures genuinely are not there to be read.
Nobody can recover it for you either. If you forget the password, the document is gone. There is no reset, no support line, no back door. Anywhere claiming it can open a protected PDF without the password is either guessing at likely passwords or is not telling you the truth.
Encryption is almost never what fails. What fails is a password somebody could have guessed. A pet's name, a birthday, a season and a year: those get worked out, and when they do the encryption did nothing wrong and the document is open anyway.
Length beats cleverness. Four unrelated words are far harder to work out than one word with letters swapped for numbers, and much easier to remember. The strength bar on the Protect page is deliberately pessimistic; if it says weak, believe it. There is a button there that will generate a strong one for you.
PDF has always let a document carry instructions like "do not print this" or "do not allow the text to be copied". They are worth using. They stop the ordinary, accidental thing: somebody printing a draft that should not have been printed, or pasting a paragraph out of a document they were asked to keep to themselves.
First, the thing that trips people up: these limits only matter after the document is open. If it has an opening password, nobody without that password is printing or copying anything, because they cannot get in at all. The limits are aimed at the person you deliberately gave the password to. They are the difference between "you may read this" and "you may read this, and please do not run off a stack of copies".
But they are requests rather than walls. They are honoured because well-made software chooses to honour them, not because the document can force the matter. Software that does not care can simply not care. That is how the format was designed, it is true of every PDF ever made, and it is not something this site or any other can change.
So the rule is: use these to prevent mistakes, never to contain a determined person. If it would genuinely harm you for someone to print or copy a document, the limit flags are not what should be standing between you and that outcome. Not giving out the password is.
The third choice on the Protect page takes a different approach. Instead of asking software not to copy the text, it removes the text. Each page is turned into a picture of itself before the file is locked, so there is nothing to select, in any reader, no matter how it behaves.
That is a real guarantee rather than a request, and it costs you something real in exchange:
That last one is not a footnote. If the document is going to a person rather than into a drawer, think about who might need to hear it read.
It is easy to run these together, so plainly:
They do not reinforce each other. A weakness in one is not a weakness in another, and strengthening one does not strengthen the rest. In particular, turning the pages into pictures only removes the text; it does not make the encryption stronger and it does not affect the owner password at all.
A PDF can carry two passwords. One lets a person read the document. The other, the owner password, marks who controls it: what the limits are, and whether the protection may be taken off.
Setting a separate owner password means you can hand out the reading password without handing over control. On this site, someone holding only the reading password will be refused if they try to remove the protection.
Be aware that this separation, like the printing and copying limits, is a convention that good software follows rather than something the document can enforce on its own. We follow it. Treat it as a clear statement of who owns the document, not as a wall.
Encryption covers what the document says. It does not hide that the document exists or roughly what shape it is. Somebody holding a locked file, with no password, can still tell:
The words, the pictures, and the title and author are all encrypted. We checked this rather than assuming it.
If even the shape of a document is sensitive, PDF protection is the wrong tool. Put the file inside an encrypted archive, and then what an outsider sees is one opaque blob.
Nowhere. The encryption runs inside the page you are looking at, on your own machine. Your document is never uploaded, and neither is your password. There is no server holding either, which means there is no server that can lose them, be compelled to hand them over, or be broken into.
Give it a long password and pick the first option. Add the printing and copying limits if you want to discourage the casual and the careless. Pick the third option only when copying must be impossible and you can afford to lose search and accessibility. And whatever you pick, write the password down somewhere that is not the same place as the document.