Protecting Sensitive PDFs
A lawyer friend once sent me a PDF with a black rectangle over a client's name. "There," she said, "redacted." I opened it in a text extractor and read the name in about four seconds. The black box was drawn as an overlay — the text underneath was fully intact and copy-pasteable.
She was mortified. The tool she'd used (a free online one) had presented redaction as a visual operation and never told her that it wasn't actually removing anything.
This is the article I wish she'd read first.
What's in this guide
What "protecting" a PDF can mean
People say "protect" to mean five different things. Understanding which one you need saves real problems.
- Prevent casual reading. A password stops a colleague from opening a file on a shared drive.
- Prevent copying. Restrict copy/paste actions. Weak protection — determined users can screenshot.
- Prevent editing. Lock the file from modification. Also weak — many readers ignore these flags.
- Prevent extraction of specific content. This is what real redaction does — removes data from the file.
- Prove authenticity. Cryptographic signatures prove who signed and that the document wasn't altered.
Most online tools blur these distinctions. The result is that people think they've done one thing when they've done another.
Passwords and encryption
When a PDF is "password protected," it's actually encrypted with a key derived from the password. The level of protection depends entirely on the encryption algorithm used.
Weak: RC4 40-bit or 128-bit
The original PDF encryption standard from the 1990s. 40-bit RC4 is crackable in seconds on any modern computer. 128-bit RC4 takes longer but is still breakable with specialised tools and a few hours. Many older PDFs are protected with this.
Strong: AES-128 or AES-256
The modern standard. AES-256 with a strong password is genuinely uncrackable by brute force with current technology. This is the level you want if security actually matters.
The catch: most "password protect PDF" tools don't tell you which one they use
Some browsers and free online tools produce RC4-encrypted PDFs and call it "password protected." It's technically accurate but deeply misleading if you need real security. If a tool won't say which algorithm it uses, assume the weakest.
Our Protect PDF tool is honest about this: we don't claim AES-256 unless the underlying library actually supports it, and we tell you if it doesn't. There are cases where client-side encryption isn't available and we say so rather than fake a "protected" file.
What passwords don't protect against
- Screenshots. Anyone who can view the file can photograph the screen.
- Manual copying. If they can read it, they can retype it.
- Metadata leakage. The file's title, author, and creator fields are often not encrypted, even when the content is.
- Weak passwords. "123456" and "password" are cracked instantly regardless of encryption strength.
Redaction: the biggest misunderstanding
Redaction is where almost everyone gets it wrong. The myth is: draw a black box over sensitive content, and it's gone. The reality: drawing a black box does not remove anything.
A PDF is essentially a stack of drawing instructions. "Draw this text at this position. Draw this image at this position." Drawing a black rectangle is just another instruction on top. The original text is still in the file, in the same place, ready to be extracted with a simple tool.
This is not a fringe concern. Real-world leaks have happened because government agencies, law firms, and companies have "redacted" documents by drawing boxes over them, then published the files online. Anyone with basic PDF tools can recover the redacted content. It's a well-documented category of security failure.
How to actually redact
Proper redaction removes the content from the file. The safest method:
- Rasterize the page. Convert it to an image, with the redaction boxes already drawn on the image.
- Rebuild the PDF. The new PDF contains only the image — the original text is gone forever.
The trade-off: text becomes non-selectable and non-searchable. The file may be larger. But the content is genuinely gone.
Our Redact PDF tool offers both modes — the "visual only" default (fast, reversible in a sense) and the "rasterize" option (slow, permanent). We recommend rasterize for anything that matters.
What about metadata after redaction?
Rasterizing removes the text from the page content, but not necessarily from the file's metadata. If the sensitive word was in the document title, redacting the page doesn't touch the title. Check metadata separately with a Metadata Editor.
Metadata removal
Every PDF carries metadata: title, author, creator application, producer library, creation date, modification date, sometimes keywords. It's invisible in normal viewing but present in the file. It's the first thing any serious investigator looks at.
Real examples we've seen:
- A "leaked" corporate document whose author field contained the email address of the person who created it
- A public government report whose creator field read "M. Smith's MacBook Pro"
- A "scanned" document whose producer field revealed it was made by a specific desktop scanner model, contradicting its claimed origin
If you're sharing anything even slightly sensitive, clear the metadata. Our Metadata Editor shows you what's there and lets you clear or replace it. It's a five-second habit that prevents most of these leaks.
Stacking protections
For genuinely sensitive documents, one protection isn't enough. The right stack depends on the recipient and the stakes.
| Document sensitivity | Recommended protections |
|---|---|
| Internal draft, friendly recipient | None needed beyond normal sharing |
| Client information, professional context | Clear metadata, AES-256 password, share link with expiry |
| Legal contract, dispute possible | Clear metadata, AES-256, cryptographic signature, secure delivery channel |
| Medical records, identity docs | Rasterize, AES-256, unique password per recipient, verify recipient before sending |
| Public disclosure with redactions | Rasterize the pages, then clear metadata, then verify with a text extractor that no sensitive text remains |
One more thing: verify before sending. After applying protections, open the file and check they actually did what you expected. Open it with a PDF reader and confirm it asks for the password. Open it with a text extractor and confirm the redacted text is gone. Five seconds of verification beats a data breach.
FAQ
Is a password-protected PDF truly secure?
Depends on the algorithm. RC4 40-bit is trivially breakable. AES-256 with a strong password is genuinely secure. Ask your tool what it uses; if it doesn't say, assume the weakest.
What's the safest way to redact a PDF?
Rasterize the page. This converts it to an image, destroys the underlying text data, and rebuilds the PDF. Redaction boxes alone are not secure.
Can someone recover a redacted PDF if I used black boxes?
Yes. The text is still in the file. Anyone with basic PDF tools can extract it in seconds. Never use only visual redaction for anything that matters.
Should I remove metadata before sending?
Yes, as a habit. It's a five-second operation with an Metadata Editor and it prevents an entire class of accidental leaks.
Are password-protected PDFs encrypted end-to-end?
No, and this is a common misuse of the term. "Password protected" means the file content is encrypted with a key derived from the password. If the file transits an email server, the server can theoretically access the content while the file is open on the recipient's device — but not while in transit, if it's within TLS. The term "end-to-end encrypted" doesn't apply to PDFs in this way.