Increasingly, people have become concerned that documents they send out, particularly in PDF format, may be open to re-distribution or misuse. Usually, this is because they do not want recipients to be able to change a document’s content or want private information to become public knowledge. If the documents have commercial value, this becomes even more important.
PDF files are often used because there is a misconception that if encrypted they are ‘secure’ and cannot be altered. But if encryption and security features such as restricting editing rely on password protection, then how well does it work?
The first thing to be aware of is the various PDF security capabilities in the Adobe PDF standard document format (ISO/IEC 32000). These are:
So, using these controls, any PDF file can be password protected, but unfortunately, that does not necessarily mean you can control document distribution and use. See why you should NOT password protect PDFs.
Software to password protect a PDF
Although there are many applications that can produce a PDF file in the Adobe standard format, not all of them allow you to implement PDF passwords or digital signatures. For instance, perhaps the most common application used to create a PDF is part of Microsoft Office. Their applications will allow you to set the password to open a document, but you cannot use them to change permissions or apply digital signatures.
The obvious choice of application for adding passwords to PDF files is Adobe Acrobat – the originator of the PDF file format. But you may find that their particular solution is not cost effective or is not readily integrated into existing applications that you already have for creating or handling PDF documents.
Don’t worry, there are a plethora of other suppliers who will allow you to apply the standard Adobe password controls to PDF documents that you create with their applications. If you already have a PDF writer application, just check that they provide those capabilities. If they aren’t able to do that, then it depends on how much (or little) you want to pay. Suppliers who charge that you might want to look at include:
These all work on your local machine and have refinements such as enabling you to encrypt in batch mode or digitally signing all documents within a folder.
If you would prefer to use cloud-based services (in other words run the application that is applying the encryption and PDF passwords on somebody else’s server) there are quite a few suppliers you could consider, although they often don’t support digital signatures. These include:
However, you have to look at whether PDF password protection offering you the kind of document security you actually need. It is not very flexible and doesn’t tick many boxes when it comes to controlling the actual use of documents (how long are they available, whether use can be revoked, personalised watermarking on printing or viewing, and so on).
If you have several recipients and several documents, you also need to consider how you would manage that situation. For maximum security, you’d want to protect each PDF with a different strong password, which would be very time-consuming . Check out the article on Working with PDF Passwords, which looks at what you need to do to get PDF password controls work for you.
Then there are the main issues that passwords can be shared or removed by authorized users, or simply cracked using password removal software. PDF permissions (restrictions to prevent editing, printing, etc.) are totally useless since they can be instantly removed.
If you are looking for additional security and more comprehensive and granular controls than the basic password protection, then you will need to look at specialist PDF DRM providers such as Locklizard. We provide PDF security with enhanced controls, license management and administration services.
How to add password to PDF in Adobe Acrobat
If you are not worried about the security issues of using passwords, or that users can easily remove restrictions, then using Adobe Acrobat is a simple way to protect a PDF with passwords. Here’s how:
This is one of the primary forms of security you can add to a PDF file, and it prevents many unauthorized users from opening the document. However, passwords are far from infallible. They can be cracked by password-guessing tools if they aren’t strong, or brute-forced, and more importantly, they can be shared. Any authorized user can share a document’s password with an unauthorized one, either through an intentional leak or due to a phishing or spearphishing attack.
If needed, Adobe allows you to set ‘additional layers of security’ which can be added to the document such as limiting the editing and printing of the PDF document. This requires an additional password to be set – see PDF Restrictions below.
There are various document permissions you can set in Acrobat to control what users can do with your PDF files.
Below is a list of PDF restriction options available:
PDF permissions are ‘protected’ with the use of an owner password. However, the owner password can be easily removed in seconds with freely available PDF password removal tools. See Removing PDF Password Permissions. This allows users to easily edit, copy, paste, and more.
Additionally, third-party PDF readers do not have to honor these controls, which effectively renders them useless. All a user needs to do is open the PDF in an application that they know does not support them.
Secure alternatives to PDF Password Protection
Passwords are just the initial piece of protection for a PDF document. Keeping PDF files and documents safe requires an exhaustive procedure for strong password conception and an easy-to-use method for users to conform to, to ensure the safety of those passwords.
To ensure that your PDF documents are properly protected, consider opting for a professional document security solution that does not rely on passwords to keep documents safe. Not using passwords means you do not have to rely on users sharing passwords, finding a way to store them securely or have administrators manage passwords on behalf of users.
PDF protection software that works
Using passwords to protect PDF files may be suitable if you are a personal user who does not intend to share them with others. As we have discussed, though, they are not suitable for use with sensitive documents or confidential business documents, as it is far too easy for users to leak documents or for hackers to remove the password.
Locklizard Safeguard doesn’t just remove the need for passwords – it offers businesses a more robust and flexible set of controls, with the ability to group users, automate document protection through an API, expire documents, and most importantly, stop editing, copying, printing, and screen grabbing.