PDF encryption is a powerful tool for protecting sensitive documents, but it is not magic. Understanding what it actually protects — and what it does not — is essential for making informed decisions about document security.
What AES-256 encryption actually guarantees
When a PDF is encrypted with a strong password using AES-256, the document content is mathematically scrambled in a way that is computationally infeasible to reverse without knowing the password. "Computationally infeasible" means that even with current supercomputing resources, brute-forcing a strong password would take millions of years. This is genuine security for the file contents — not security theatre.
The weak link: password strength
The strongest encryption standard is only as secure as the password protecting it. A common word, a name, a date, or any short sequence can be cracked in seconds to minutes using freely available GPU-accelerated password cracking tools. A 12-character random password mixing case, numbers, and symbols would take thousands of years to crack by brute force. Use a password manager to generate and store truly random passwords for important documents.
Permissions are not true security
PDF permission flags — disabling printing, copying, or editing — are an access control mechanism for legitimate users, not a cryptographic barrier. A user can remove these restrictions using freely available tools. Think of permission flags as a polite request, not a technical lock. They are appropriate for managing access within an organisation where users are trusted, but should not be relied upon to prevent a determined external recipient from removing them.
Beyond encryption: other security considerations
Even a strongly encrypted PDF can be compromised after it is decrypted. A recipient who opens the file with the correct password can still screen-capture it, photograph it, print it, or share the decrypted version. True confidential document control requires access management systems with per-user authentication, audit logging, and remote revocation. For everyday business confidentiality — protecting a document during transit and at rest on a recipient's device — AES-256 encryption with a strong password is entirely appropriate and effective.
Practical recommendations
Use a unique password for each encrypted document. Share the password through a different channel than the document itself. Verify that the recipient can successfully open the document before distributing it widely. Document your passwords in a secure password manager, not in a spreadsheet or sticky note.
