Passwords
Open password vs permissions password in a PDF
By DeckleUpdated
A PDF open password stops anyone reading the file without it. A permissions password lets everyone open and read the file but asks readers to block actions such as printing, copying text or editing. Use an open password when the content itself is private. Password protect PDF in Deckle sets an open password with AES-256 encryption; it does not set separate printing or editing restrictions.
Three different privacy tasks
Password
Controls access
Metadata
Document properties
Redaction
Selected page content
Choose the change; inspect the saved copy
Open password vs permissions password
| Open password | Permissions password | |
|---|---|---|
| Also called | User password, document open password | Owner password |
| Asked for | Before any page is shown | Only when someone changes the security settings; restricted actions are simply unavailable |
| Without it you can | Do nothing; the pages stay encrypted | Read every page, and often take screenshots |
| Blocks | Reading the file | Printing, copying, editing, page extraction, form filling, as chosen |
| Enforced by | The encryption itself | The reader app, which is expected to respect the flags |
| Set by Deckle | Yes | Only as the same value as the open password, with no restriction settings |
The key difference is in the last two rows. An open password protects the content with encryption: without the key, the pages cannot be read. A permissions password relies on the reader to honour the restrictions. Most well-known readers do, but the content is readable as soon as the file opens, and tools that ignore the flags can remove them.
Which one to use
Use an open password when the content should not be seen by anyone who gets hold of the file: a payslip, a medical letter, a contract draft or anything sent by email where the message could be forwarded or intercepted.
Use a permissions password when you want people to read the document but discourage particular uses: a published price list that should not be edited, or a report that should not be printed. Treat it as a request, not a barrier.
Use both when only named people should read the file and you also want to limit what they do with it. Make the two passwords different. Preview accepts the same value for both, but then anyone with the open password also has full permissions.
How to add an open password with Deckle
- Open Password protect PDF and choose your PDF, or drop it onto the page.
- Type a password of at least six characters in Password.
- Type it again in Confirm password.
- Choose Protect this PDF.
- Download the copy with "(protected)" in its name, and open it to check that it asks for the password.
Deckle sets the same value as the owner password, so anyone who can open the file has full permissions. The full walkthrough is in how to password protect a PDF.
How to add permission restrictions
Deckle does not set print, copy or edit restrictions. These apps do:
- Preview on a Mac. Choose File > Export, click Permissions, leave the checkboxes for the actions you want to restrict unselected, and enter an Owner Password. You can also select Require Password To Open Document to set both at once. Click Apply, then Save.
- Adobe Acrobat Pro. Choose All tools > Protect a PDF, then Encrypt with Password. Select Restrict editing and printing of the document, enter a permissions password, and choose the Printing Allowed and Changes Allowed options and whether copying is allowed.
Removing each kind
To remove an open password you need to know it. To remove restrictions from a file that opens without a password, Unlock PDF works with the password field left empty and saves a copy with no encryption and no restrictions. See why a PDF opens but cannot be edited for how to tell which one you have.
Tips
- Pick the open password for anything private. Restrictions do not hide content from someone who already has the file.
- Never reuse the open password as the permissions password in apps that offer both, or the restrictions do nothing.
- Remove metadata before locking. Restrictions and encryption do not hide the author or editing history from people who can open the file. Clear them with Remove PDF metadata first.
- Tell recipients what to expect. If printing is blocked on purpose, say so in your message to save them a support call.
Frequently asked questions
Does a permissions password encrypt the PDF?
Yes, the file is encrypted, but anyone can open it because the open password is empty. The encryption is there so the restrictions are stored securely, not to keep the content private.
Can someone remove a permissions password without knowing it?
Often, yes. Because the file opens freely, tools including Deckle's Unlock PDF can save a copy without the restrictions. Remove restrictions only from files you have the right to change.
Why does Deckle set the same password for both?
Because its job is to keep the file closed to anyone without the password. Separate restrictions would need a second password and a reader that respects them.
Can I stop someone taking a screenshot of a PDF?
No. Once a page is on screen, it can be photographed or captured. Only an open password keeps the content from people who do not have it.
Related tools
- Password protect PDF to add an open password
- Unlock PDF to remove a password or restrictions
- Remove PDF metadata to clear document properties