Files are processed in your browser, not uploaded. Privacy →
Deckle
Open a PDF
Skip to guide

Passwords

What AES-256 PDF encryption protects (and what it doesn't)

By DeckleUpdated

When Deckle password protects a PDF, it encrypts the file with AES-256, the strongest encryption the PDF standard defines (the PDF 2.0 method, revision 6 of the standard security handler). Without the password, the pages, text and images cannot be read. AES-256 protects the file while it is stored or sent; once someone opens it with the password, they can read, save and forward it like any other PDF. Use Password protect PDF and choose Protect this PDF to apply it.

Password protect PDF

Three different privacy tasks

Password

Controls access

Metadata

Document properties

Redaction

Selected page content

Choose the change; inspect the saved copy

Conceptual comparison · access, properties and content require separate checks. No single task certifies complete privacy.

How to protect a PDF with AES-256 in Deckle

  1. Open Password protect PDF and choose your PDF, or drop it onto the page.
  2. Enter a password of at least six characters in Password.
  3. Enter it again in Confirm password.
  4. Choose Protect this PDF.
  5. Download the copy and open it to check that it asks for the password.

The result screen reads "Password required to open" with "AES-256 protection added". There is no setting to choose a weaker method: Deckle never writes the older RC4 encryption.

What AES-256 protects

  • The page content. Text, images and drawings on every page are encrypted.
  • Embedded files and streams. Attachments and other data stored in the PDF are encrypted along with the pages.
  • The file at rest and in transit. A protected PDF on a lost laptop, in an email or on a shared drive cannot be read without the password.

The encryption is applied in your browser. The file is not uploaded, and the password is not stored, put in a link or written into the result record.

What it does not protect

Situation Why AES-256 does not help
Someone has the password The password is the key. Anyone who has it can read the file
The password is weak A short or common password can be guessed, however strong the encryption
The recipient forwards a copy Once opened, the reader can save an unprotected copy or print it
You want to stop printing or copying Deckle has no permission settings, and restrictions rely on the reader to honour them
You want to prove who sent the file Encryption does not identify the sender; a digital signature does
Text should be removed for good Encryption hides content from outsiders but the recipient still sees it

The strength of the protection depends on the password. AES-256 means trying keys at random is not practical; it does not stop someone trying password1 or the recipient's birthday. Use a long passphrase or a random password from a password manager. How to choose a strong password for a PDF has examples.

Compatibility

AES-256 first appeared as an Adobe extension to PDF 1.7 and is part of PDF 2.0 (ISO 32000-2). Current releases of Adobe Acrobat Reader, Preview on a Mac and the PDF viewers built into major browsers open it. Readers from before that change may fail to open the file or report a wrong password. If a recipient has that problem, ask them to open the file in a current reader.

Other details of the protected copy

  • The same password is set as the owner password, the one that grants full access, so there are no restrictions for someone who has it.
  • Pages, page sizes and text are unchanged.
  • The Producer property is set to Deckle. Other properties stay, and they are readable once the file is opened. Clear them first with Remove PDF metadata if they should not travel with the document.
  • Before the result appears, Deckle checks that the new file refuses an empty password and opens with yours.

Tips

  • Make the password the strong part. CISA recommends at least 16 characters, or a passphrase of four to seven unrelated words.
  • Send the password separately. See how to share a password-protected PDF.
  • Keep a record of the password. Strong encryption also means a lost password cannot be worked around.
  • Do not rely on encryption for redaction. If the recipient must not see a detail, remove it from the page before you protect the file.

Frequently asked questions

Is AES-256 the same encryption banks use?

AES is a widely used standard cipher, and 256 is the key length. In a PDF, the key is derived from your password, so a weak password weakens the protection.

Can AES-256 PDF encryption be cracked?

Not by trying keys, in any practical time. Attacks on protected PDFs target the password instead, which is why its length and randomness matter.

Does Deckle use AES-256 when it unlocks a file?

Unlocking removes encryption entirely. Unlock PDF opens files with older RC4 and current AES encryption and saves a copy with none.

Does Deckle keep my password?

No. It is used once to encrypt the file in your browser and is not stored or sent anywhere.

Related tools

Sources