Redaction, Passwords and Encryption: What Actually Protects a PDF

Most PDF security failures are not sophisticated attacks. They are people using a tool that does something different from what they assumed it did. The black box that isn't redaction, the password that only asks nicely, the "protected" file that any viewer will open — these are documentation problems, not cryptography problems.

Here is what each mechanism actually does.

Drawing a black box is not redaction

This is the single most consequential misunderstanding in document handling, and it has produced a long, recurring series of public embarrassments involving law firms, government departments and news organisations.

PDF is a layered format. When you draw a filled rectangle over text using an annotation or drawing tool, you add a new object on top of the text. The text underneath is untouched. It is still in the file, still selectable, and still extractable — by copying and pasting, by running text extraction, or simply by deleting the rectangle in an editor.

The document looks redacted on screen. It is not redacted in any meaningful sense. Anyone who receives that file has the supposedly hidden information.

Real redaction removes the underlying content, then draws the marking. The text ceases to exist in the file. Our Redact PDF tool works this way, and any tool that claims redaction should be doing the same — if in doubt, redact a test document, then try selecting the text under the box and pasting it somewhere.

That test takes ten seconds and is worth running against any tool before you trust it with something sensitive.

The metadata trap

Even with genuine content removal, a redacted document can leak through the side door. PDFs carry metadata: author name, the originating filename, the software used, creation and modification timestamps, and sometimes the full path the file was saved to — which can itself reveal a client name or case number.

A properly redacted document with a filename like Smith-settlement-confidential-DRAFT3.pdf recorded in its metadata has not achieved much.

Check and strip metadata as a separate step. It is not covered by redaction and most tools will not do it automatically.

Two different passwords, doing two different things

PDF supports two distinct passwords, and conflating them causes most of the confusion.

The user password (sometimes called the open password) is required to open the document at all. Without it the file cannot be read. This is backed by real encryption: the content is genuinely scrambled, and without the password there is nothing to display.

The owner password (permissions password) does something quite different. It sets flags declaring that the document should not be printed, copied, or edited. The file itself opens without any password at all.

Those permission flags are advisory. They are a request that viewer software chooses to honour. Compliant readers like Adobe Acrobat respect them, which is why they appear to work. Plenty of other software ignores them entirely, and stripping them is trivial — which is exactly what an unlock tool does for files where you have lost the password to your own document.

So: if you need a document to be genuinely unreadable without a password, set a user password. If you set only an owner password, you have added an inconvenience, not a protection.

What encryption strength actually means here

When you do set a user password, the encryption is real, but its strength depends on the PDF version and — much more importantly — on your password.

Older PDF encryption used 40-bit RC4, which is now trivially broken and should be considered equivalent to no encryption. PDF 1.7 and later support AES-256, which is genuinely strong. Most current tools default to AES; older software may not.

The practical weak point is almost never the algorithm. It is that people choose a password like Invoice2026 and then email it to the recipient in the same message as the attachment. AES-256 protecting a six-character dictionary word is a very strong lock on a door with the key taped to it.

If you are password-protecting a document that matters, send the password through a different channel than the document. A phone call or a message on a different platform is sufficient and takes thirty seconds.

Flattening: the underrated one

Flattening merges interactive elements — form fields, annotations, layers, signature appearances — into the static page content.

This matters for two reasons.

First, form data in a filled PDF lives in a separate structure from the visible page. Some viewers display filled values while others show the empty template, which is why a completed form occasionally arrives looking blank. Flattening bakes the values into the page so everyone sees the same thing.

Second, unflattened form fields can be edited by the recipient. If you send a signed and completed document as a live form, the values in it are changeable. Flattening prevents casual alteration — not a determined forger, but the common case of accidental or opportunistic editing.

What none of this protects against

Worth stating plainly, because tools rarely do: once someone can read a document, they can copy its contents. They can screenshot it, retype it, or photograph the screen.

Copy-protection flags, disabled printing, and view-only modes address convenience and casual copying. None of them prevent a determined recipient from extracting the information, and no PDF feature can. If information genuinely must not leave a controlled environment, that is a problem for access control and legal agreements, not for a file format.

Understanding this boundary is what separates realistic document handling from a false sense of security.

A short decision guide

"Nobody unauthorised should read this." Set a user password with AES encryption. Send the password separately. Accept that authorised readers can still copy content.

"Specific information must be removed before sharing." Use true redaction that deletes the underlying content, then strip metadata, then verify by trying to select the text. Never rely on a drawing tool.

"This shouldn't be casually edited." Flatten the document. Optionally add an owner password, understanding it is advisory.

"This needs to prove who signed it." That is a digital signature question rather than a password one — cryptographic signatures detect tampering after the fact rather than preventing access.

"I've lost the password to a document I own." For owner-password permission flags, an unlock tool will clear them. For a user password, there is no shortcut; that encryption is doing its job.

Verify, don't assume

The recurring theme in every real-world PDF leak is that someone assumed a tool did what its label implied.

Before you rely on any of these mechanisms for something consequential, run the test. Redact a document and try to paste the hidden text. Password-protect a file and try opening it somewhere else. Flatten a form and check the values survive. Five minutes of verification prevents the category of mistake that ends up in a news story.