Password Protect a PDF, or Use Something Else? Decide by the Risk

"Password protect this PDF" sounds like one task, but people mean several different things by it. Sometimes the worry is that the email lands in the wrong inbox. Sometimes it is a laptop left on a train. Sometimes the reader is perfectly welcome to see the file, and the worry is that they will change a figure, copy a paragraph into their own report or print fifty copies. Each of those is a different risk, and the PDF format has a different tool for each, plus a few cases where the right answer is not a PDF feature at all.

So start by finishing the sentence: I am worried that someone will. If the ending is read it who should not, you need encryption with an open password. If it is change or reuse what they are allowed to read, you need permissions, flattening or simply your own unchanged original as proof. If it is lose track of a pile of files, an encrypted archive helps. And if the file is going into an upload portal, protection may be the thing that gets it rejected. The list below matches common risks to answers.

This is the risk an open password handles best. Email autocomplete picks the wrong Sam, a colleague forwards a thread without reading the attachments, or a shared mailbox is visible to more people than you thought. With an open password, the PDF is encrypted, and anyone without the password sees a prompt instead of your tax return. The Protect PDF tool sets an Open password with AES-256, the method kept in the current PDF standard, ISO 32000-2, and readable in every current PDF viewer on phones and computers.

Turn on Encrypt metadata too, so the document title and author are hidden as well; a title such as Divorce settlement draft can say more than you intend. The password itself is the weak point, which the last section covers. One limit is worth knowing before you rely on this: protection travels with the file, but once the right person opens it, they can save an unprotected copy. An open password stops strangers, not the people you trust with it.

Portals are the main exception. Australia's ImmiAccount guide to attaching documents says outright that it does not accept encrypted or secured PDFs, and other visa and job portals behave the same way. If a protected file needs to go into one, remove the password first with the Unlock PDF tool, using the password you already know, and upload the unlocked copy. The guide to splitting PDFs for upload portals covers the rest of getting files portal-ready.

The second password a PDF can carry is the permissions password, which Adobe's password security overview describes as restricting features such as printing, editing, copying content and adding comments. The reader opens the file normally, without typing anything, and their PDF software grays out the blocked actions. Adobe's page on restricting printing and editing lists the usual levels: no printing, low-resolution printing at up to 150 dpi, or full printing, and changes ranging from none through filling in forms up to anything except extracting pages.

These limits are useful as a clear signal and against casual reuse. They are weaker than they look, because the reader can already see every word: the file has to be readable for the page to appear, and the limits depend on the software choosing to honor them. Mainstream readers do; a determined person can find tools that do not. That is why Unlock PDF can lift permission limits when you leave the password field empty. Use permissions to set expectations, and keep your own unchanged original as the reference if a dispute about wording could ever arise.

A filled-in PDF form keeps its answers in fields that stay editable: anyone with a PDF reader can click a box and change a number. Comments, highlights and stamps are separate objects too, which can be moved or deleted. Flattening draws all of these into the page itself, so they look exactly the same but stop being editable objects. Flatten PDF does this with What to flatten set to Everything, or only Form fields if review comments should stay live. Flattening cannot be undone, so keep the editable original if you may need to change an answer.

Flattening also helps with a privacy risk people rarely think of. A PDF can carry things you cannot see: hidden layers, earlier revisions and text covered by a black box drawn on top rather than removed. With Flatten as set to Image, each page becomes a picture of what is visible, and everything else is gone; the price is that text can no longer be selected or searched. Pair flattening with an open password when a final form is also private: flatten first, then protect the flattened copy.

When a mortgage broker wants payslips, bank statements, an ID scan and a tax return, protecting each PDF separately means four passwords or one password typed four times. An encrypted archive wraps them all in one file with one password. The Zip Files tool creates ZIP archives with AES-256 encryption by default, which modern archive tools open, and it can also produce 7Z. The one surprise with ZIP is that the list of names stays readable: WinZip's notes on AES encryption say the encryption applies to the content of the files. A file called Passport scan Jane Doe.pdf tells a stranger something even when it cannot be opened.

If the names are private, choose 7Z and switch on Hide file names, or rename the files to something neutral before packing. Avoid the older ZipCrypto method, which is easy to break, unless the recipient has only very old software. Check one practical point before choosing an archive: some built-in extractors on phones and older systems cannot open AES-encrypted ZIPs. If the recipient runs into an error message, the guide to unzipping files and what each ZIP error means is a useful link to send along.

Encryption is only as good as the password and the way it travels. A password in the same email as the attachment protects nothing, because whoever gets the email gets both. Send it by a different route: a text message, a phone call, a chat app the recipient already uses, or agree on it in person once and reuse the system for a regular contact such as an accountant. For a password you pick yourself, length matters more than symbols. NIST's digital identity guidelines require at least 15 characters for a password that is the only protection, drop mandatory mixes of character types and ask for checks against lists of common passwords.

A file password is exactly that kind of single protection, since nothing else stands between a copy of the file and its contents. Four or five unrelated words make a long password that is easy to read out over the phone. Use a different one for each recipient or each batch, and store it in a password manager rather than in a note next to the file. The checklist below sums up the habits that matter, and the warning after it covers the one mistake that cannot be fixed.