Encryption stops the wrong person opening the file. Permissions politely request that readers block printing. Redaction removes content. Metadata stripping removes the trail around it.
They are not interchangeable, and the most common leak is using permissions where encryption was needed, or a black rectangle where redaction was needed.
PDF security has a reputation for being confusing, and the confusion is mostly definitional. Four different mechanisms get described in the same language, appear in the same menus, and protect against completely different things.
Four mechanisms, four jobs
- EncryptionStops opening
- Permission flagsRequests restraint
- RedactionRemoves content
- Metadata strippingRemoves provenance
- Digital signatureProves integrity
- WatermarkSignals, does not stop
Read that list as a set of boundaries rather than a menu. Encryption has nothing to say about what a permitted reader does next. Redaction has nothing to say about who can open the file. A signature proves the document has not changed and does nothing to keep it private.
Encryption, and what it covers
A user password encrypts every content stream in the document. Current tools use AES-256, which has no practical attack, so the protection reduces to the quality of the password.
What it covers is narrow and worth stating plainly: someone who has the file and not the password cannot read it. It does not cover anything that happens after a legitimate recipient opens it. They can copy the text, screenshot the pages, print it, or forward the file and the password together.
Permissions, and why they are not security
An owner password sets flags asking readers to block printing, copying, editing or extraction. The document is not encrypted against the person holding it. It opens for anyone.
Enforcement is entirely voluntary. Acrobat and most mainstream readers honour the flags, which is why the mechanism feels real. Anything that chooses not to honour them reads the document normally, and clearing the flags takes seconds because there is no cryptography involved.
Redaction, and the black rectangle problem
This is the most consequential misunderstanding in the whole subject, and it has produced real disclosures in court filings, government releases and corporate reports.
Drawing a black rectangle over text in a PDF editor adds a black rectangle to the page. The text underneath is still in the file, still selectable, still extractable by copying the page or running any text extraction tool. The rectangle is a graphic sitting on top, not an eraser.
The content is gone
- Text and image data are deleted from the content stream
- Copying the page yields nothing where the redaction is
- The file size drops if the removed content was substantial
- Nothing to recover, because nothing remains
- Survives text extraction and forensic inspection
The content is covered
- Original text sits untouched beneath the graphic
- Select-all and copy retrieves it immediately
- File size is unchanged or slightly larger
- Recoverable by anyone who thinks to try
- Has caused repeated real-world disclosures
Metadata, the part nobody looks at
Every PDF carries information about itself that never appears on any page. The document information dictionary holds title, author, subject, keywords, the software that created it and timestamps for creation and modification. XMP metadata often duplicates and extends that.
The author field routinely contains a real name or a corporate username. The title is frequently whatever the source document was called, which may be considerably more revealing than the filename you chose. Timestamps establish when work was done. None of this is visible while reading, and all of it travels with the file.
- Author name or usernameDocument info
- Original document titleDocument info
- Creating applicationProducer field
- Creation and edit timesTimestamps
- Earlier revisionsIncremental saves
- Comments and annotationsAnnotation layer
Putting it together
Most sensitive documents need more than one of these, applied in the right order.
Remove what must not be there
Redact properly, or delete the page entirely. This comes first because everything after it assumes the content is already gone.
Strip the metadata
Author, title, producer and timestamps. Do this after editing, since editing tools write their own metadata as they go.
Encrypt with a user password
AES-256, a long passphrase, and the password delivered on a different channel from the document.
Verify the result
Open it, select all, copy, and look at what you get. Check the metadata is actually empty. Confirm the password prompt appears.
Protect a PDF with AES-256
Real encryption, applied in your browser. Neither the document nor the password is uploaded.
Common questions
Where the mechanisms stop.
01Is a password-protected PDF actually secure?
With a user password and AES-256, the encryption itself is sound and the protection reduces to the password's strength. With only an owner password it is not secure at all, because the document opens for anyone and the restrictions are advisory.
02Why is drawing a black box over text not redaction?
Because it adds a graphic on top of the page without touching the text underneath. The words remain in the content stream and can be retrieved by selecting and copying the page. Real redaction deletes the underlying data.
03Can I stop someone printing or copying my PDF?
You can request it through permission flags, and cooperative readers will honour the request. You cannot enforce it. Anything that chooses to ignore the flags reads and prints the document normally, and clearing the flags takes seconds.
04What metadata does a PDF carry?
Title, author, subject, keywords, the creating application, and creation and modification timestamps, plus an XMP block that often duplicates them. The author field regularly contains a real name or corporate username, and none of it is visible while reading the document.
05Does encryption stop the recipient sharing the file?
No. Encryption controls who can open the document, not what someone does once they have opened it. A recipient with the password can forward both. If that is the concern, the answer is contractual rather than technical.
06What is the single most important check before sending?
Open the finished file, select all, and copy it into a text editor. That one action reveals failed redactions, text you thought was an image, and hidden layers, which between them account for most real-world PDF disclosures.