PDF Protection: protect PDF files – stop printing, copying, save as, editing

  How to stop PDF sharing / Stop PDF theft

Safeguard PDF Security and Enterprise PDF DRM provide PDF protection by using encryption, DRM, and licensing controls.  These document controls stop PDF sharing and printing, protect against copying, prevent editing, and enable secure distribution of your PDFs.

Safeguard’s PDF protection provides many security features and in-built restrictions to protect PDFs, and unlike Adobe restrictions, these cannot be removed.  Most of the basic protection features are applied by default (stop PDF copying, editing, screenshots, etc.) whereas others you can change to suit your requirements (allow or stop PDF printing, enforce expiry, etc.).  All of these security restrictions stop PDF files from being shared with unauthorized users, control how they are used, and how long for.  A list of these PDF restrictions are provided below.

Safeguard does not use passwords to protect PDFs since users can easily remove password protection from a PDF.  Instead PDFs are protected using individual encryption keys that are securely and transparently relayed to authorized devices from a web server and stored encrypted in a keystore on the local device.  The keystore is locked to individual devices so it cannot be copied and moved elsewhere.

Safeguard’s secure PDF Viewer is required to open secured PDF files.  This can either be installed on a device (Windows, Mac, iOS, Android), run from a USB stick (completely offline zero installation solution), or accessed via a web browser (zero installation).  When a user opens an encrypted PDF document, the Viewer checks to see if the decryption key is available.  If it is not present then the Viewer checks with the administration server to see if the user is authorized to view the PDF.  If they are, the decryption key is transparently relayed to the client and the protected document opens.  DRM controls are enforced by the Viewer software.

  Stop PDF Printing / Limit PDF printing

Safeguard protects PDFs from printing – it disables printing of PDF documents by default so you do not have to apply any additional controls to stop a PDF being printed.  As well as using Safeguard to stop PDF printing for specific (or all) documents, you can stop printing on a per-user basis. This lets you disable it for some users but allow it for others using the same protected document (you don’t have to distribute a new document with different protections for each user). Documents can be secured with zero prints available (to stop PDF being printed) and then individual users can be granted print rights by altering the number of prints available.

If you allow printing, you can limit the number of times a PDF can be printed by each user to stop users distributing high-quality copies of documents to others.  You can also enforce black & white or grayscale printing of color documents.  Document watermarking is recommended if you allow printing to discourage photocopies from being made – see PDF watermarking below.

Safeguard’s PDF protection disables print to PDF and other file printers so that if printing is allowed, users cannot print to PDF files, XPS, or any other file format.

  Stop PDF copying

How can you stop PDF copying when anybody can easily duplicate a digital file?

The important issue is not whether you can stop a PDF from being copied, but whether the recipient of the copied file can use it.  If you encrypt a PDF with a password, you can give a copy of the PDF along with the password to another user and they can use the file.  The protection provided is, therefore, worthless in preventing sharing.

Safeguard effectively stops PDF copying.  The protected file is of no use to another user without the decryption key required to open it.  Decryption keys are stored in a keystore which is locked to the device users registered the license on. As a result, only authorized users can open protected PDFs.

Authorized users are also prevented from saving the PDF in an unprotected format (no editing or saving options are available), and Locklizard never stores unprotected files on disk where users could recover them.  For additional security, the Locklizard Viewer prevents screen grabbing, and document owners can disable printing so that users cannot make photocopies of printed documents.

To summarize, to protect PDFs from copying, you have to encrypt the PDF files to stop unauthorized access, use licensing controls to lock documents to devices, and apply DRM controls to constrain document usage so they cannot be easily shared.

To protect PDF files from content copying, see the “Protect PDF against content & text copying” section.

  Preventing saving PDF / Save As

If you are going to prevent document sharing and editing, you have to stop ‘Save As’ from being used.  Otherwise, PDF documents can be saved in unprotected formats.  The simplest way to do this is to not have the facility available to begin with.  Some products use JavaScript to disable the Save As menu item or shortcut keys, but JavaScript can be easily removed (or turned off) in a browser environment, so it cannot be used securely.

Unlike Adobe Acrobat Reader, Safeguard’s PDF protection has no ‘Save’ or ‘Save As’ functionality in its secure PDF Viewer.  The only documents that can be copied are secured PDFs, and they are useless to unauthorized recipients as they need the correct decryption keys to open them.

Because ‘Save As’ options are not made available, Safeguard’s Secure PDF Viewers automatically stop PDF conversion to Word and other file formats.  Users cannot convert protected PDFs (PDC files) to Word using external applications either, as the files are encrypted and can only be processed by Safeguard Secure PDF Viewers.

  Disable or prevent PDF Download

Stopping PDFs from being downloaded (the ability to disable or prevent PDF download) is very similar to preventing copying in principle.  People think forcing users to view secure PDF documents online is more secure because they can’t be manipulated on a device outside of the ‘secure environment’.

They might want to think again.  Every browser works by caching information to disk.  Also, browser environments are possibly the least secure of all for document controls.  They give no control over the actual environment and system functions because allowing random web code to change your system behavior would be an awful idea. As a result, stopping screen grabbing and printing to file drivers is impossible for web viewers.  See Secure Downloads for additional information on stopping downloads and copying.

Most secure data room systems disable PDF downloads because the downloaded PDF files contain no protection other than a watermark that can be easily removed in a PDF editor.  To stop the browser from caching the PDF on the user’s system, they convert your PDF pages to images when you upload them.  However, this provides a poor user experience since images are slow to display and print, and features such as search, bookmarks, and annotations are unlikely to be available.  If you allow the user to download the PDF, it will be converted back to a PDF file.  Further, users can still screenshot the document and convert it back to text with an OCR tool.

Conversely, if you encrypt a PDF file and the user does not have the decryption key to use it, it does not matter if they can download it.  They won’t be able to open it anyway.  If you apply DRM and licensing controls, authorized users will be restricted as to what they can do with downloadable PDF files (for example, not being able to share them with others).  So, preventing the download of a PDF file does not make it any more secure. In fact, many online PDF Viewers that ‘prevent downloads’ are less secure since they decrypt PDF files on the server and deliver them to the client in an unprotected form.

Safeguard’s installed Viewers let users download secured PDFs while enforcing all DRM controls, leaving no reason to disable or prevent PDF downloads.

  How to prevent someone from forwarding a PDF

You cannot stop PDF files from being forwarded or emailed to others, but you can stop the recipients from using those files.

Many cloud-based systems claim to stop PDF forwarding.  However, users can share their login credentials with others to give them access to your documents anyway.  If a system uses document links, there is nothing stopping an authorized user from emailing those links to other users along with the login information.  Some systems state that they lock PDF files to email addresses or domains, but that just means that you have to log in using that email address or any email address that belongs to the domain.  It does not stop PDF forwarding because authorized users can still give their login credentials to others.  That is also true of 2FA codes, which provide little extra protection from intentional sharing.

A Safeguard-protected PDF file can be forwarded and emailed to another user, but the recipient cannot view it unless the document owner authorizes them to use it.

If you are the document publisher, you can email secure PDF files to users, knowing they cannot be opened if they fall into the wrong hands.  If a secure PDF is accidentally forwarded to the wrong person, they will not be able to use it in any way.  See also stop copying, downloading and emailing.

  Stop PDF Editing / Lock PDF so it cannot be edited / Block PDF from editing

Adobe Acrobat has built-in ‘security’ that lets you stop PDF editing (restrict editing PDF or stop PDF modifying), printing, and saving.  To enable these features in Acrobat, you must apply a permissions password to protect the PDF.  The problem is that the password you set is completely useless.  It is no more effective than putting a watermark on the document that says, ‘Please do not edit or copy this PDF’.  Numerous free and paid PDF password remover programs will remove Adobe Acrobat permissions passwords in seconds.  Adobe restrictions do not really disable editing in PDF files since users can easily remove any PDF restrictions you apply.

Safeguard stops PDF editing/modifying by default — it will lock a PDF so it cannot be edited and block all forms of content copying. By disabling the editing of PDF files, you also stop content/text copying.  Safeguard Secure PDF Viewer also disables editing of PDF forms — form fields cannot be edited or modified, but form fields can still be filled in – see secure PDF forms.

Users can still add comments to PDF files (if you allow this option), but PDF content is always protected from editing, ensuring that your original content cannot be altered.

   Make text in PDF not searchable / Make text not selectable

If you search for how to make a PDF not searchable or not selectable, the results will suggest flattening your PDF pages to images.  This works to an extent.  Displaying pages as images makes a PDF text not searchable or selectable using cursors and touch screens.  However, many do not realise that this process is reversible.  Optical character recognition (OCR) tools analyze the shape of each character in the image and check them for matches in their database.  The character is then replaced with real, editable text.  Modern OCR tools even use AI neural networks and machine learning to accurately detect and convert images of text in a wide variety of scenarios.

OCR tools are built into many PDF readers.  Sometimes, the OCR reader even kicks in automatically as soon as users open a flattened PDF.  Mobile, desktop, and browser OCR apps are, so hosting a PDF online does not prevent text from being selected or searched.

To make a PDF truly not searchable or text not selectable, use Safeguard.  Our built-in flattening feature allows you to easily convert PDF content into images and then prevent opening in third-party readers.  Users utilize Safeguard’s Secure Viewer application, which further prevents OCR by stopping screenshots and screen recordings.

   Protect PDF against content & text copying

In some PDF protection products, if editing is disabled, you can still highlight and copy text.  Safeguard makes text in a PDF not selectable – it stops users from copying text and other content within a document.  There is no copy-paste option available, and text cannot be highlighted for selection (text is not selectable, nor are images), so it cannot be copied and pasted.

  Stop Screenshots / Protect PDF from screen capture

Many PDF DRM products claim to stop screenshots, but if you look closely, they mainly claim to prevent Windows PrintScreen.  There are many free screen grabbing or screen capture applications available that users can download to bypass this restriction easily.

Safeguard stops users from taking screenshots with both Windows and third-party software applications.  It uses many methods, including a screen mask option, which is overlaid over the secure PDF document if the cursor is moved to another active application.  No PDF DRM product, however, can stop all screenshots (users can just take photographs of the screen), so dynamic watermarks are recommended as a copying deterrent.  If a user’s name and email are displayed on a screenshot, they will probably be less likely to share it with others (especially on the internet).

  PDF Expiry and expiring PDF files

Safeguard enables document publishers to expire PDF files so they can’t be used after a certain amount of time.  The following options are available:

• expire documents on a fixed date
• expire documents after a number of days
• expire documents after a number of opens or views
• expire documents after a number of prints

These options can be used together so that you can enter a number of days/views/prints and a fixed date, and whatever occurs first causes the document to expire.  You might, for example, want a user to be able to use your documents for a 15-day trial period but have those documents expire on a fixed date regardless of whether the trial period is used or not.

Expiry dates can be changed in the administration system at any time, and document publishers can increase the number of views/prints available for each user.

   Revoke PDF Files

The ability to revoke PDF files is an important part of any document security solution.  There may be times when the wrong document was published, a user has left your company, or you think a specific document has been compromised.

Safeguard lets you revoke PDF files instantly (when the document is set to check with the administration system each time it is opened), or specific users (so that all documents they have access to become inaccessible).  If you have created PDF files that only check with the administration system every n days, then PDF revocation will only occur once a check has occurred.  With Safeguard, PDF files can be revoked no matter where they are located.  You can also revoke access to multiple PDF files instantly and group documents into publications to make revocation easier for common groups of documents.

   PDF Watermarking

No DRM system is foolproof.  Even if screenshots are prevented, users can take photographs of the screen using a camera.  Similarly, if you allow printing, users can print and scan back in printed documents.

To discourage users from making copies of protected documents, you can add dynamic PDF watermarks to viewed and/or printed content.  By using dynamic variables, you only have to protect a PDF once for all users (rather than watermarking and protecting each document individually for each user in Adobe Acrobat) as user data (name, company, email, date/time, etc.) is  inserted at view/print time.

Safeguard’s PDF protection lets you position dynamic PDF watermarks anywhere on the page (including custom locations) and choose your own font and color.  You can use different watermarks for viewed and printed documents and both text and image watermarks are supported.  PDF watermarks can be displayed behind content (so they are less obtrusive to the user), and you can choose not to display watermarks on the first page of a document if you have a cover image that you want to leave unmarked.

Unlike Adobe watermarks or those added using other PDF editing tools, Safeguard’s watermarks are permanent and cannot be easily removed.  See How to remove a watermark from a PDF.

   Lock PDFs to country locations, domains and IP addresses

In addition to Safeguard’s ability to lock PDFs to individual machines (so that they cannot be used on unauthorized devices), you can lock PDFs to specific countries, a domain or an IP address range.

This is done at the user level or a global level (for all users).  In this way, you can easily restrict all users to viewing secured PDFs from, say, your office location in the US.  This is particularly useful if users have laptops that they are allowed to take home – locked PDF files can then only be viewed at the office and not when the user is at home or at other locations where they could be shown to others.

  Track PDF use

Safeguard Enterprise PDF DRM lets you track PDF use so you can see when users have viewed and/or printed your PDF files.

This is useful if you want to check whether a particular user has viewed a document yet – especially if they claim to have not received it.  Tracking PDF files requires users to be connected to the internet since a record has to be stored on a cloud server when a PDF file is viewed/printed.  You may, therefore, only want to track PDF use for specific documents; otherwise, users will have to be constantly online.

   Secure PDF Hosting & Secure PDF Distribution

Locklizard provides secure PDF hosting with Web Publisher (secured PDF files are stored on a cloud server either hosted by Locklizard or yourselves).  Alternatively, you can distribute PDF files securely as you would any other file.

Many providers offer secure PDF hosting or enable you to secure PDF files online, but these are not as secure as you may think.  Most cloud-based PDF DRM systems, for example, offer ‘secure PDF hosting’ but protect PDF documents online on a cloud server.  Your unprotected PDF files are uploaded to a server where they are stored, encrypted, and DRM controls applied before being stored again in a protected format.  This may be fine for ebooks, but what about sensitive and confidential company documents?  Do you really want them sitting on a server in an unprotected format for any length of time?  Safeguard’s PDF protection cloud-based PDF DRM system generates secure PDF files locally (encryption and DRM controls applied) and then uploads them to a cloud server so they can be viewed by users in a browser.  Your PDF files can never be compromised by server vulnerabilities as they are encrypted locally, uploaded via SSL, and stored encrypted on the server.

If you prefer to host secure PDF files yourself then you can distribute them just like any other file (email, USB, web site download, etc.).  Safeguard generates PDC files (secure PDF format) that can only be opened with our secure PDF Viewers.  It does not matter who has access to your secure PDF files because they are encrypted and can only be viewed by authorized users.  So, you can make them freely available via a web site for download without worrying about password access controls.

For completely offline secure PDF distribution, you can protect PDF files from USB sticks using Safeguard PDF Portable.  This lets you distribute our secure PDF Windows Viewer, secure PDF documents, and a keystore on USB sticks for offline viewing.  Authorized users can additional secured PDF documents and decryption keys at a later date when they become available without the USB stick having to be returned to you.

Locklizard can host the administration system (where you create users and authorize document usage), or you can host it on your own servers.  This is separate from the protection of PDF files (which is done locally on your computer), so you have greater control over the secure distribution of your documents and who has access to them.

  Batch Protect PDFs with command line

Safeguard enables you to batch protect PDF files using a command line tool.  Using this PDF security tool, multiple administrators can protect PDFs in a consistent manner, apply PDF protection quickly, copy to multiple folders, and schedule PDF protection based on certain events or a date/time.  Using the command line, administrators don’t have to learn what DRM security controls to apply – they just run a batch file. It provides far better security than bulk password protecting PDF files with zero additional effort.

Safeguard also lets you automate administrative functions (adding users, assigning document access) using our ecommerce API.  This enables companies to delegate admin controls by creating simple interfaces where specific functions are made available.  You can also automate user creation and document access after a purchase has been made online (e.g. a secured PDF ebook).