Security & Privacy7 min readUpdated Aug 24, 2026

PDF Password Protection & Encryption Standards Explained: RC4 vs AES-128 vs AES-256

Protecting confidential PDF files against unauthorized opening, copying, or tampering requires understanding standard PDF encryption specifications. This guide covers User vs Owner passwords, cryptographic ciphers, and how to lock documents securely.

PDFDock Cryptography & Security Team

Information Security Engineers

Key Technical Takeaways

User (Open) Passwords encrypt the actual payload streams and prevent unauthorized reading of document contents.
Owner (Permissions) Passwords restrict printing, modifying, copying text, or filling form fields.
Modern PDF encryption relies on Standard Security Handler specifications defined in ISO 32000-1 and ISO 32000-2.
Client-side encryption ensures your password and plaintext document never cross external networks.

1. User Password vs Owner Password

The PDF specification establishes two distinct levels of password protection: ### 1. User Password (Document Open Password) The User Password encrypts the entire internal content stream (text, vectors, images, annotations). When someone attempts to open the PDF in Acrobat, Preview, Chrome, or any viewer, they must enter the password to derive the decryption key. Without it, the file cannot be rendered or read. ### 2. Owner Password (Permissions Password) The Owner Password allows the document author to configure fine-grained behavioral restrictions, such as: - Disallowing printing (or restricting to low-resolution printing). - Preventing text selection, image copying, and clipboard extraction. - Blocking page reordering, insertion, or rotation. - Disallowing digital annotations or form filling.

Owner passwords alone do not provide cryptographic data protection against determined attackers because some open-source PDF readers ignore software permission flags. For true confidentiality, always set a strong User Open Password.

2. Cryptographic Ciphers: RC4, AES-128, AES-256

Over the evolution of the PDF format, several encryption ciphers have been standardized:

Cipher Standard	PDF Version	Security Level	Compatibility
RC4 (40-bit)	PDF 1.1 – 1.3	Obsolete / Insecure	Universal Legacy Support
RC4 (128-bit)	PDF 1.4 – 1.5	Standard Protection	Supported across all PDF viewers
AES-128 (CBC)	PDF 1.6	High Security	Supported by all modern viewers
AES-256 (ISO 32000-2)	PDF 2.0 / Acrobat X+	Military-Grade Security	Requires modern PDF readers

3. How PDF Stream Encryption Works Internally

When a PDF is encrypted, the document trailer dictionary includes an /Encrypt reference pointing to a dedicated encryption dictionary. This dictionary contains: - **Filter (/Standard)**: Declares the security handler managing authentication. - **V and R Values**: Version and Revision numbers indicating the cryptographic schema. - **O and U Strings**: Computed hash strings used to authenticate the Owner and User passwords using cryptographic salt and hash algorithms (such as MD5 or SHA-256). - **P Bitmask**: A 32-bit integer encoding the permissions flags.

4. Best Practices for Creating Strong Document Passwords

To ensure your encrypted documents withstand brute-force dictionary attacks: - Use a minimum of **12 to 16 characters** containing a mixture of uppercase, lowercase, numbers, and symbols. - Avoid common dictionary words, employee names, or public company names. - Never send the PDF file and its decryption password in the same email thread; share the password via a separate secure channel (e.g. Signal, SMS, or encrypted messaging).

5. How to Password-Protect a PDF with PDFDock

Protecting your PDF on PDFDock is completely private and takes seconds: 1. Go to [Protect PDF](/tools/protect-pdf/). 2. Drop your PDF file into the dropzone. 3. Type a strong password into the encryption field. 4. Click **Process Files** to apply standard encryption to all object streams in browser RAM. 5. Click **Download** to receive your password-locked PDF.

Frequently Asked Questions

Can PDFDock recover my password if I forget it?▼

No. Because PDFDock runs 100% locally and stores zero data, there are no backdoor keys or recovery mechanisms. Always keep a secure backup of your password in a password manager.

Will an encrypted PDF open on iPhone and Android?▼

Yes. All modern mobile operating systems (iOS Files/Safari, Android Chrome/Drive) natively support standard PDF password prompts.

Does PDFDock upload my password or document to a server?▼

No. Encryption keys are generated and applied exclusively inside your browser's local memory buffer.