PDF passwords are two different things wearing one name. One is real cryptography: without the password, the file is noise. The other is a polite request: please don't print this. Most bad advice about protecting PDFs — and most myths about "cracking" them — come from mixing the two up. Here's which is which, how to apply each for free, and what removal can honestly do.
The user password (open password) encrypts the document. Every reader demands it before rendering a page, and the AES-256 version of it is the same cipher standard used for classified-data handling. The owner password (permissions password) doesn't hide anything: it guards a set of flags — can print, can copy text, can edit — that well-behaved readers like Acrobat and Preview honor and that plenty of free tools simply ignore. Encrypt with only an owner password and you get the classic "opens freely but Print is greyed out" file that banks and insurers send.
| You set | To open, a reader needs | What it actually stops |
|---|---|---|
| User password only | The password, always | Everyone without it — cryptographically |
| User + owner password | The user password | Same, plus restrictions once open |
| Owner password only | Nothing | Honest readers only — restrictions, not secrecy |
| No password | Nothing | Nothing |
One deliberate exception belongs on this table: accessibility. The PDF format technically allows blocking screen readers, and the option exists in some tools. Ours doesn't expose it — turning it off excludes blind readers from documents they're authorized to read, for no security gain.
The no-purchase routes, in order of convenience:
qpdf --encrypt --user-password=... --owner-password=... --bits=256 -- in.pdf out.pdf. Exactly what our browser tool runs underneath, for people who live in a terminal.Encrypting rewrites the PDF: streams are enciphered, an encryption dictionary is added, and the file grows a little. In a verified run with our tool's engine, a 3-page, 1,852-byte document came back as a 2,665-byte AESv3/256-bit file — 813 bytes of structural overhead, all pages present, and a wrong password rejected with the standard "invalid password." Decrypting with the right password returned the 3 pages with title and author metadata intact at 1,993 bytes. Content survives the round trip; only the packaging differs. Two practical notes: keep an unencrypted original somewhere safe (the password is unrecoverable from the file), and share the password out-of-band — a different channel than the attachment.
Restrictions are the tempting checkbox and the misunderstood one. Set no-print on a contract draft and Acrobat will grey out Print; so will Preview and the browsers. But a restriction is a flag the reader chooses to respect — it is not encryption of anything. Tools that ignore flags (several free editors, most PDF libraries) will print or copy the same file happily. So the rule: use restrictions for courtesy and compliance nudges — "please don't print the draft" — and use the open password whenever the requirement is that someone must not see the content. If your motivation is legal (NDA material, exam papers), the open password is the only one of the two that means anything.
Now flip it around. Removing protection falls into exactly two cases. If you have the password — your own file, or one you're authorized to open — decryption is the format working as designed: our Remove PDF Password page does it locally, and even handles the restrictions-only files (empty user password) with nothing typed at all, which is the case most online "password removers" quietly serve while implying they cracked something.
If you don't have the password, no honest tool recovers the content: the key comes from the password, AES-256 has no master key, and offline guessing only works against weak passphrases on files you hold. The realistic recovery paths are unglamorous: try your password manager's older entries, check for an unprotected copy from the same sender, or ask for a fresh one. Legality is equally plain: unlocking documents you own or are authorized to modify is ordinary; stripping protection from material you don't have rights to can violate law or contract depending on where you are. The math is neutral; the responsibility isn't.
AES-256 encryption — or removal of a password you own — entirely in your browser. The file never uploads.
Password Protect a PDF →User password for secrecy, owner password for courtesy, and never confuse the two. AES-256 is free and standard — no subscription needed to do this correctly. Removing protection is trivial and legitimate when the password is yours, impossible and dishonest to promise when it isn't. And if the sensitive thing in your workflow is who made the document rather than what's in it, pair the password with a metadata scrub before anything leaves the machine. For files arriving damaged instead of locked, that's a different job: Repair Corrupt PDF handles it the same local, no-upload way.