PDF security: what actually protects your documents

We get some version of "is this PDF secure?" from customers quite frequently, and the honest answer is always "secure against what?" PDF security isn't one setting. It's three or four separate mechanisms that people routinely conflate, and the gaps between them are exactly where sensitive documents get exposed.

A password is not encryption, but it can be

Most people's mental model of a "password-protected PDF" is roughly right, but the strength varies enormously depending on how it was applied. Modern PDF encryption (AES-256, the current standard) genuinely scrambles the file's contents so it's unreadable without the password. Older tools — and plenty of software still in use — default to weaker legacy encryption, or in some cases just restrict certain actions in a viewer without encrypting the underlying content at all, meaning the raw text can still be extracted with the right tool despite the file being "locked." If you're relying on a password for anything sensitive, it's worth confirming which of these your tool is actually doing.

Permissions are a request, not a wall

PDFs support permission flags that can disable printing, copying, or editing in compliant viewers. These are worth having as a deterrent and for compliant software, but they're not a security boundary — they rely on the viewer respecting the flag, and plenty of tools simply ignore it or offer an easy override. Treat permissions as a courtesy setting, not a control you'd bet anything important on.

The metadata problem

One of the more common ways sensitive information leaks out of a PDF has nothing to do with the visible content. Author names, edit history, embedded comments, and even earlier draft text can persist in a file's metadata or in improperly flattened redactions — the black box drawn over a paragraph doesn't remove the text underneath unless the tool actually strips it, and several well-publicized document leaks over the years came from exactly this: a black rectangle sitting on top of perfectly readable, copyable text. Before sharing anything sensitive externally, it's worth confirming your tool flattens redactions and strips metadata rather than just visually covering it.

What to actually check

For anything that matters — contracts, financial records, anything with personal data — three things are worth confirming: the file uses real encryption if it's password protected, redactions are flattened rather than just drawn over the top, and access is logged somewhere outside the file itself, since a PDF has no memory of who opened it. That last point is the one most document security setups miss entirely, and it's the one that matters most once something goes wrong and you need to know who saw what.