Do PDF Passwords Really Protect a Document? (Owner vs User)

Partly. A PDF user password genuinely encrypts the file with AES-256 — nobody opens it without the password. An owner password, though, is a permissions flag readers can (and often do) ignore. Only the user password is real security. Use Zro7 Password Protect PDF to set one locally.

The two-password model

• User password (a.k.a. open password) — required to decrypt and open the file. Backed by AES-128/256.
• Owner password (a.k.a. permissions password) — encodes restrictions like 'no printing' or 'no copying'. Compliant viewers honor them; many don't.

Why owner passwords are weak

1. The PDF is not encrypted by the owner password — the restriction flags are.
2. Removing the flags takes 3 lines of code with any PDF library.
3. Public tools ('unlock PDF') do it in one click.
4. Never rely on owner passwords for security — only for polite hints.

How strong is AES-256 on a PDF?

As strong as AES-256 anywhere else — brute-force is infeasible with a strong passphrase. The weakness is the passphrase itself: 'password123' cracks in seconds. Use 4+ random words or a password manager.

Adobe vs Zro7 for setting a password

• Adobe Acrobat Pro — sets user + owner passwords; requires the $20/mo subscription.
• Zro7 — free, browser-based, AES-256 user password, all local.
• Same crypto, different pricing model.

Steps to add a real password

1. Open Zro7 Password Protect PDF.
2. Drop the PDF.
3. Enter a strong passphrase (16+ chars, or 4 random words).
4. Download the encrypted file — nothing was uploaded.

Updated December 23, 2026 · Zro7 editorial team.