How to Protect a PDF With a Password

PDF password protection is widely misunderstood, partly because the format supports two different things under one name. Knowing which one you are applying determines whether the document is actually protected or merely inconvenient to misuse.

Two kinds of PDF password

• An open password (sometimes called a user password) encrypts the file. Without the password the contents cannot be read at all. This is real protection.
• A permissions password (owner password) leaves the file readable and asks viewers not to print or copy. Many readers ignore it. This is a courtesy, not a control.

Where Pdf2Go stands today

Pdf2Go's browser-based toolkit does not currently implement PDF encryption, so the Protect PDF tool is marked as coming soon rather than shipped in a weakened form. Publishing something that looks like a lock without providing one would be worse than publishing nothing, because people would rely on it.

What to use in the meantime

1. Most desktop PDF readers and office suites can export a PDF with an open password. This is the closest equivalent.
2. An encrypted archive — a password-protected 7z or zip using AES — protects the file in transit and is widely supported.
3. For a recurring workflow, a shared drive with per-person access is usually stronger than any password you would send by email anyway.

Never send the password in the same message as the file. If the mailbox is compromised, both are lost together.

Choosing a password

Encryption strength is irrelevant if the password is guessable. Use a long passphrase of several unrelated words rather than a short complex string; it is easier to communicate over the phone and much harder to brute-force. Avoid anything derived from the document name, the client name or the date.

What a password does not do

Once someone legitimately opens the document, nothing stops them from screenshotting, forwarding or re-saving it. Encryption protects the file in storage and in transit. It does not control what an authorised reader does next — that is a matter of trust and, where relevant, contracts.

Conclusion

Use an open password when you need real protection, treat permissions settings as a polite request, send credentials over a separate channel, and be sceptical of any tool that promises more than the format can deliver.