Password-Protecting a PDF: What AES-256 Encryption Protects (and What It Doesn't)
A password-protected PDF hides its contents from anyone without the password. But some details stay visible, and in practice the strength of your password decides how safe the file is.
What our Protect PDF tool actually does
Protect PDF encrypts your file with a password you choose (at least 4 characters), using 256-bit AES encryption -- the method the current PDF standard, PDF 2.0 (ISO 32000-2), specifies for password-protected PDFs. Adobe Acrobat and Reader have supported 256-bit AES since version 9, so the recipient only needs the password and an up-to-date PDF reader.
Some very old PDF software can't open this type of file. For example, the developers of the iText PDF library note that iText 5 and earlier versions can't read it. If someone can't open your protected file, ask them to update their PDF reader.
When we checked a protected file with three independent PDF programs (October 2026), opening it without the password failed, and opening it with the password worked normally.
The password you set is used to open the file. Our tool does not add separate restrictions on printing, copying or editing, so anyone who has the password can do everything with the document that they could with the original.
Until 5 October 2026 our tool used an older method, 128-bit RC4 encryption, which Adobe Acrobat and Reader have supported since version 7. Files protected before that date keep that older method.
What is hidden, and what isn't
We protected a three-page test report and then searched the raw bytes of the protected file for anything readable without the password (October 2026).
The page text could not be found, and neither could the document's title. Encryption scrambles the text, images and other content of every page, and the document's properties -- such as its title and author -- are kept in the file but encrypted too, so they only appear once the file is opened with the password.
Some structural details are not encrypted, because PDF encryption is designed to protect content, not the file's layout. The page count and each page's size could still be read directly from the file. And, as with any file, its name and size are visible to anyone who can see the file -- so don't put sensitive information in the file name.
| Part of the file | Readable without the password? |
|---|---|
| Text on the pages | No |
| Images on the pages | No - all page content is encrypted |
| Title, author and other document properties | No - kept in the file, but encrypted |
| Number of pages | Yes |
| Size of each page | Yes |
| File name and file size | Yes - like any file |
Why your password matters more than the encryption
Guessing a 256-bit encryption key directly isn't practical, but the key is protected by your password -- and a password can be guessed. Anyone with a copy of the file can try passwords on it as many times as they like, with no lockout. So the real question is how long it would take to try every possible password of yours.
To give a feel for it, we timed a simple password-guessing script on a single processor core. Against a file protected by our tool it managed about 130 guesses per second. Against the same file protected with the older 128-bit RC4 method, the same script managed roughly 2,100 to 2,700 guesses per second -- the newer method takes far more computing work to check each password. The table shows the worst case at 130 guesses per second: the time to try every combination of a given length.
Dedicated password-recovery software running on graphics cards is many times faster than our simple script, and real attackers try common words and patterns first. Treat these times as the most optimistic case, not a guarantee.
| Password | Possible combinations | Time to try them all |
|---|---|---|
| 4 lowercase letters | 456,976 | About 1 hour |
| 6 lowercase letters | About 309 million | About 4 weeks |
| 8 lowercase letters | About 209 billion | About 51 years |
| 8 characters: upper, lower and digits | About 218 trillion | About 53,000 years |
| 10 characters: upper, lower and digits | About 839 quadrillion | About 205 million years |
Faster tools reduce these times a great deal. A password that is a word or name can be found far sooner than the table suggests.
A note on encryption standards
PDF 2.0 deprecates every use of RC4 encryption and promotes AES-256 instead, as summarised by the PDF Association. That is why our tool now uses AES-256.
If you protected a file with our tool before 5 October 2026, it uses 128-bit RC4. To move it to AES-256, open it with its password in your PDF reader, save or print a copy without a password, and run that copy through Protect PDF again.
Whatever the method, for everyday privacy -- sending a payslip, a bank statement or a signed form so that it can't be opened by someone who intercepts it or finds it later -- the deciding factor is still the password.
Good practice for protecting a PDF
Use at least 10 characters mixing upper-case letters, lower-case letters and digits, and avoid names, dates and dictionary words.
Send the password separately: for example, email the PDF and send the password by text message or tell it to the recipient by phone. A password in the same email as the file protects nothing.
Keep an unprotected original somewhere safe. A forgotten password cannot be recovered or reset -- not by us, and not by anyone else without guessing it -- and we don't keep a copy of your file or your password. Your upload and the protected file are deleted from our server as soon as your download is ready.
Don't put sensitive details in the file name, since the name stays visible.